Remediate BIND, Struts, Strapi, ONLYOFFICE, ProFTPD flaws by Oct 11, 2026 CISA KEV deadline
CISA added five exploited vulnerabilities to its catalog. Each entry lists a due date of 11 October 2026 for remediation.
Key points
- CISA added five new entries to the Known Exploited Vulnerabilities catalog this week.
- The additions cover ISC BIND, Apache Struts, Strapi, ONLYOFFICE and ProFTPD.
- All five entries share a listed due date of 11 October 2026.
The US Cybersecurity and Infrastructure Security Agency added five exploited vulnerabilities to its Known Exploited Vulnerabilities catalog. Our data desk analysis of public records confirms these additions were made within the last seven days. None of the newly listed flaws are linked to known ransomware activity. The entries list a due date of 11 October 2026.
Which specific software products are affected?
The catalog update includes one vulnerability from each of five distinct vendors. ISC BIND is affected by CVE-2015-5477. Apache Struts is impacted by CVE-2016-3081. Strapi CMS has CVE-2023-22894 listed. ONLYOFFICE Docs is affected by CVE-2021-3199. ProFTPD is impacted by CVE-2015-3306. These entries span legacy and modern infrastructure components.
What is the timeline associated with these fixes?
All five vulnerabilities share the same due date. The catalog lists 11 October 2026 for each entry. This date is fixed in the CISA catalog for each addition. The source material does not specify compliance requirements or consequences for missing this date. Organisations should note the date as listed in the public data.
How many new entries were added recently?
Our data desk counted five KEV additions in the past seven days. This count is derived directly from CISA’s public catalog data. No other vulnerabilities were added in this specific weekly window. The absence of ransomware links distinguishes this batch from previous high-profile additions. The focus remains on exploited flaws across diverse software categories.
What is the technical nature of these flaws?
The source material identifies the CVE IDs and affected products but does not detail the technical mechanics. CVE-2015-5477 affects ISC BIND. CVE-2016-3081 affects Apache Struts. CVE-2023-22894 affects Strapi. CVE-2021-3199 affects ONLYOFFICE Docs. CVE-2015-3306 affects ProFTPD. Users must consult vendor advisories for technical specifics.
What to do and how to stay safe: CISA
- Audit your environment for installations of ISC BIND, Apache Struts, Strapi, ONLYOFFICE and ProFTPD.
- Check vendor documentation for the specific CVE IDs to determine if your version is vulnerable.
- Note the 11 October 2026 due date listed in the CISA catalog for planning purposes.
- Monitor CISA’s KEV catalog for any changes to the remediation timeline or new exploited entries.
Step-by-step guide: Emergency Patching: The High Cost of Fixing Critical Flaws Fast
General security guidance from the DarkWeb Dispatch newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Are any of these vulnerabilities linked to ransomware?
No, our analysis of the source material indicates zero known ransomware use for these five additions.
What is the due date for these vulnerabilities?
The listed due date for all five entries is 11 October 2026.
Which vendors are affected by this update?
The affected vendors are ISC, Apache, Strapi, ONLYOFFICE and ProFTPD.
