Five software flaws have been slotted into the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog, and federal civilian agencies now have three weeks to shut them.
The oldest is CVE-2015-3306, a CVSS 10.0 access-control bug in the ProFTPD file server. By abusing the SITE CPFR and SITE CPTO commands, a remote attacker can read or overwrite arbitrary files.
Then comes a 9.8-rated path-traversal flaw, CVE-2021-3199, in ONLYOFFICE Docs, surfacing once JSON Web Token validation has been switched on. A crafted sequence slipped into an image upload parameter can open the door to remote code execution.
The catalog also gains CVE-2023-22894 in Strapi, which leaves sensitive fields held in cleartext exposed, together with flaws in Apache Struts and ISC BIND.
Deadlines fall in late October and early November. KEV entries rest on observed exploitation rather than theory, so defenders should read the due date as the outer edge of the window, not the goal. Inventory any internet-facing ProFTPD, ONLYOFFICE, Strapi, Struts, and BIND instances now, and verify the fixed release is the one actually running.
CISA’s catalog is built to force prioritization. The trap sits with the older CVEs: teams often assume a five-year-old bug was handled long ago.
