Critical CVEs & Hacking Techniques Weekly

The critical CVEs this week all arrived in one batch: CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalog on 08 October 2026, tied to a Chinese state-linked espionage campaign. One of the five, a CVSS 9.8 path traversal flaw in ONLYOFFICE Document Server, carries unauthenticated remote code execution and is the patch-first priority. All five are confirmed exploited in the wild, and four of the five have had public exploit code available for years.

The pattern this week is not a new zero-day. It is a nation-state actor reaching into networks through vulnerabilities first disclosed between 2015 and 2023, some of them a decade old, because they were never patched.

CVE-2021-3199: ONLYOFFICE Document Server path traversal remote code execution

What it is: CVE-2021-3199 is a path traversal vulnerability in the /upload endpoint of ONLYOFFICE Document Server that lets a remote attacker write files outside the intended directory by placing a /.. sequence in an image upload parameter, leading to remote code execution in deployments where JWT is in use.

Affected products and versions: ONLYOFFICE Document Server 5.1.5 through 5.6.2 (CISA’s range); all versions before 5.6.3 per NVD.

Severity: CVSS 9.8 (CVSS 3.1, Critical) under the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Exploitation status: Confirmed in the wild. CISA, the FBI, and the NSA named CVE-2021-3199 as actively exploited by a China-linked actor in joint advisory AA26-281A, published 08 October 2026. CISA added it to the KEV catalog the same day. Federal civilian agencies must patch or discontinue use by 11 October 2026.

Patch status: Fixed in ONLYOFFICE Document Server 5.6.3, released by the vendor; organizations running anything earlier remain exposed.

What to do: Upgrade to Document Server 5.6.3 or later this week. There is no configuration workaround: the flaw is reachable in the JWT configuration that production deployments use, so JWT is the condition, not a defense. Until patched, restrict access to the /upload endpoint to trusted networks. Audit internet-facing Document Server instances, including those embedded in Nextcloud or ownCloud deployments, for the version string and for unexpected files written outside the upload directories.

Why it matters: An attacker who reaches this flaw gets unauthenticated code execution on the server hosting an organization’s document collaboration platform, which typically holds live copies of contracts, financial records, and internal correspondence. From there, the same joint advisory describes follow-on credential harvesting and lateral movement into the wider network, which is the kind of multi-stage chain that continuous web application and API pentesting is built to find before an attacker does.

CVE-2016-3081: Apache Struts Dynamic Method Invocation remote command execution

What it is: CVE-2016-3081 allows a remote, unauthenticated attacker to execute operating system commands on an Apache Struts application when Dynamic Method Invocation is enabled, by passing a crafted method prefix in a request parameter.

Affected products and versions: Apache Struts 2.3.19 through 2.3.20.2, 2.3.21 through 2.3.24.1, and 2.3.25 through 2.3.28, when Dynamic Method Invocation is enabled. DMI is disabled by default; only deployments that turned it on are exposed.

Severity: CVSS 8.1 (CVSS 3.1, High), vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. NVD also carries a CVSS 2.0 score of 9.3.

Exploitation status: Confirmed in the wild. CVE-2016-3081 is one of the eight vulnerabilities named in CISA, FBI, and NSA advisory AA26-281A, published 08 October 2026, describing exploitation by a China-linked actor using an automated scanning tool. CISA added it to the KEV catalog on 08 October 2026, with a federal remediation deadline of 11 October 2026.

Patch status: Fixed in Struts 2.3.20.3, 2.3.24.3, or 2.3.28.1, depending on the branch in use.

What to do: Upgrade to the patched release matching your current branch this week. If an immediate upgrade is not possible, disable Dynamic Method Invocation as an interim mitigation. Inventory every internet-facing application built on Struts 2.3.x, since this framework version is frequently embedded in vendor products rather than run standalone, which makes it easy to miss in an asset list.

Why it matters: Command execution on a Struts application server gives an attacker a foothold inside whatever network segment hosts that application, which the same advisory ties to subsequent credential theft and access to adjacent systems. A framework vulnerability from 2016 still being exploited in 2026 shows that attackers are scanning for whatever is reachable, not just what was disclosed this year.

CVE-2015-3306: ProFTPD mod_copy arbitrary file read and write

What it is: CVE-2015-3306 is an improper access control flaw in the mod_copy module of ProFTPD 1.3.5 that allows a remote, unauthenticated attacker to copy files to and from arbitrary locations on the server, which can be used to write a web shell into a web-accessible directory.

Affected products and versions: ProFTPD 1.3.5 with the mod_copy module enabled (NVD lists 1.3.5; Debian also patched its 1.3.4a package).

Severity: CVSS 10.0 (CVSS 2.0, the only score NVD has published for this CVE), vector AV:N/AC:L/Au:N/C:C/I:C/A:C.

Exploitation status: Confirmed in the wild. CVE-2015-3306 is named in CISA, FBI, and NSA advisory AA26-281A, published 08 October 2026. CISA added it to the KEV catalog the same day, with a federal remediation deadline of 11 October 2026. A working Metasploit exploit module for this exact vulnerability has been publicly available on Exploit-DB since 2015.

Patch status: Fixed upstream in ProFTPD 1.3.5a, released May 2015 (ProFTPD bug 4169). Debian and Ubuntu shipped backported fixes to their 1.3.5-based packages the same month. Disabling the mod_copy module removes the vulnerable code path regardless of version.

What to do: Upgrade to ProFTPD 1.3.5a at minimum, and preferably to a current supported release. Disable mod_copy in proftpd.conf unless a specific workflow depends on it. Treat any internet-facing FTP server discovered during an asset inventory as a priority to decommission or isolate, since FTP itself is now a legacy protocol in most environments.

Why it matters: Arbitrary file write on an FTP server is a direct path to a web shell and full compromise when the FTP root overlaps with a web server’s document root, a common legacy configuration. A decade-old, maximum-severity bug that is still being found and used shows that attackers get as much value from scanning for abandoned services as from chasing new disclosures.

CVE-2015-5477: ISC BIND TKEY assertion failure denial of service

What it is: CVE-2015-5477 allows a remote attacker to crash an ISC BIND name server by sending a crafted TKEY query that triggers a REQUIRE assertion failure, forcing the daemon to exit.

Affected products and versions: All BIND 9 releases from 9.1.0 through 9.9.7-P1 and 9.10.0 through 9.10.2-P2.

Severity: CVSS 7.8 (CVSS 2.0, the only score NVD has published), vector AV:N/AC:L/Au:N/C:N/I:N/A:C.

Exploitation status: Confirmed in the wild. CVE-2015-5477 is named in CISA, FBI, and NSA advisory AA26-281A, published 08 October 2026. CISA added it to the KEV catalog the same day, with a federal remediation deadline of 11 October 2026. A public proof-of-concept denial-of-service exploit has been available on Exploit-DB since 2015.

Patch status: Fixed in BIND 9.9.7-P2 and 9.10.2-P3.

What to do: Upgrade any BIND server still running a pre-patch 9.9.x or 9.10.x build this week. Confirm authoritative and recursive name servers are on a currently supported BIND branch, since the 9.9 and 9.10 lines are themselves long past end of life. Monitor for unexpected BIND process restarts, which can indicate an attempted or successful denial-of-service attempt.

Why it matters: A successful attack takes down name resolution for whatever depends on that server, which can cascade into an outage for every application and user relying on it, rather than exposing data directly. Finding this flaw still unpatched in 2026, eleven years after disclosure, points to infrastructure services that were deployed once and never revisited.

CVE-2023-22894: Strapi sensitive data disclosure through query filters

What it is: CVE-2023-22894 allows an attacker with access to the Strapi admin panel to discover sensitive user data by filtering users on columns that hold sensitive values and inferring the value from the API response. A super admin can recover the password hash and password reset token of every user; a lower-privileged admin panel account can recover sensitive details of API users in lower roles.

Affected products and versions: Strapi (the @strapi/strapi npm package) versions before 4.8.0. NVD’s description cites versions through 4.5.5; the vendor fix shipped in 4.8.0.

Severity: Sources conflict. NVD’s own analysis scores it CVSS 4.9 (CVSS 3.1, Medium), vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, which requires high privileges to exploit. CISA’s Authorized Data Publisher entry for the same CVE scores it CVSS 9.8 (CVSS 3.1, Critical), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which assumes no privileges are required. The two assessments disagree on whether authentication is a precondition.

Exploitation status: Confirmed in the wild. CVE-2023-22894 is named in CISA, FBI, and NSA advisory AA26-281A, published 08 October 2026, as one of the eight vulnerabilities exploited by the same China-linked actor. CISA added it to the KEV catalog on 08 October 2026, with a federal remediation deadline of 11 October 2026.

Patch status: Fixed in Strapi 4.8.0.

What to do: Upgrade to Strapi 4.8.0 or later this week regardless of which severity assessment you credit, since both agree the underlying filtering bug is real. After upgrading, rotate admin panel passwords and invalidate outstanding password reset tokens, since both may already have been recovered on an exploited instance. Restrict admin panel access to trusted networks and review which accounts hold admin panel roles.

Why it matters: A Strapi instance is usually the backend for a public-facing website or application. An attacker who gets any admin panel account can walk from that foothold to every user’s password hash and reset token, which is a full takeover of the content platform. The scoring conflict itself is a reminder that CVSS numbers from different authoritative bodies can disagree, and patch urgency should not wait for them to agree.

New hacking technique: automated N-day revival at nation-state scale

What researchers demonstrated: The FBI, CISA, the NSA, and cybersecurity agencies from the United Kingdom, Australia, Canada, Japan, New Zealand, and Spain published joint advisory AA26-281A on 08 October 2026, detailing how the China-linked actor known as Flax Typhoon, operating through the Beijing-based Integrity Technology Group, used an in-house scanning tool to find and exploit eight vulnerabilities first disclosed between 2014 and 2023 across government, critical manufacturing, healthcare, and IT networks. The Department of Justice and FBI simultaneously announced the court-authorized seizure of seven domains tied to the operation’s infrastructure.

How it works:

1A Python-based scanning tool named MicroScan, carrying more than 1,300 penetration-testing scripts, mass-scans internet-facing systems for unpatched vulnerabilities, old and new alike, across products including Apache Struts, ISC BIND, ProFTPD, ONLYOFFICE, Strapi, Ivanti Pulse Connect Secure, F5 BIG-IP, and VMware vCenter.

2Where MicroScan confirms a working vulnerability, the actor follows with hands-on exploitation, including password spraying and credential stuffing against Microsoft 365 using a tool the advisory calls EBurst, and mailbox access through a tool called office-cli.

3A second tool, FishHub, runs spear-phishing campaigns that deliver follow-on payloads once an initial foothold is established, which the advisory ties to intrusions at Taiwanese universities.

4Persistence is maintained with SoftEther VPN client installations, and scanning traffic is routed through Sparrow, which controls a Mirai-variant botnet of compromised internet-of-things devices descended from the Raptor Train botnet taken down in September 2024, to obscure the origin of the activity.

5The campaign has run since at least mid-January 2021, and infrastructure tied to the c0cc[.]cc domain, one of the seven seized, was still active as recently as 09 September 2026.

Why it matters: This is not a zero-day campaign. Every vulnerability named in AA26-281A was patchable years before this advisory, which means the actor’s advantage came entirely from scale of scanning and patience, not technical novelty. CISA’s Acting Executive Assistant Director for Cybersecurity, Chris Butera, described the actors as positioning themselves inside critical infrastructure networks, including operational technology, to disrupt functions at a time of their choosing, which changes the risk calculus from data theft to availability.

What to do: Treat this advisory as an asset inventory exercise, not a single-patch fix: confirm whether any of the eight named CVEs exist anywhere in your environment, meaning the five new KEV entries plus CVE-2014-6278 (Bash, Shellshock), CVE-2019-11510 (Pulse Connect Secure) and CVE-2021-22205 (GitLab), all three already in KEV, including inside vendor products that embed an old framework version you did not choose yourself. Hunt for unauthorized SoftEther VPN client installations and unusual Microsoft 365 authentication patterns consistent with automated password spraying. Treat internet-facing systems running software more than three years old as a standing priority for continuous, automated penetration testing rather than a one-time cleanup, since this campaign’s entire advantage came from the gap between annual testing cycles and attackers who scan every day.

CISA KEV additions, 05 to 11 October 2026

CVE	Product	CVSS	Date added to KEV	Federal due date
CVE-2021-3199	ONLYOFFICE Document Server	9.8 (v3.1, NVD)	08 Oct 2026	11 Oct 2026
CVE-2016-3081	Apache Struts	8.1 (v3.1, NVD)	08 Oct 2026	11 Oct 2026
CVE-2015-3306	ProFTPD mod_copy	10.0 (v2.0, NVD)	08 Oct 2026	11 Oct 2026
CVE-2015-5477	ISC BIND	7.8 (v2.0, NVD)	08 Oct 2026	11 Oct 2026
CVE-2023-22894	Strapi	4.9 NVD / 9.8 CISA-ADP (conflicting)	08 Oct 2026	11 Oct 2026

All five additions landed in a single batch on 08 October 2026, tied to advisory AA26-281A. No further KEV additions were confirmed for 09, 10, or 11 October 2026 as of this report. The full, current catalog is available at the CISA Known Exploited Vulnerabilities Catalog.

How FireCompass helps

Every CVE in this week’s KEV batch is reachable through the same entry point: an internet-facing web application or service running software nobody has looked at since it was deployed. FireCompass’s AI agents run continuous web application and API pentesting against that exact surface, chaining discovery, exploitation, and evidence-backed validation rather than flagging a version string and moving on. The platform’s false positive rate runs under 2 percent, against 40 to 70 percent for traditional scanners, which matters most on old, noisy software like the products named in this week’s advisory. Most organizations still test annually, leaving roughly 20 percent of their surface checked in any given year, while attackers like Flax Typhoon scan continuously for exactly the gaps that creates.

Run a Free AI Pen Test

Frequently asked questions

Which CVEs were actively exploited this week?

Five CVEs were confirmed actively exploited and added to CISA’s KEV catalog on 08 October 2026: CVE-2021-3199 (ONLYOFFICE Document Server), CVE-2016-3081 (Apache Struts), CVE-2015-3306 (ProFTPD mod_copy), CVE-2015-5477 (ISC BIND), and CVE-2023-22894 (Strapi). All five were named in joint advisory AA26-281A.

What is the most critical CVE this week?

CVE-2021-3199 in ONLYOFFICE Document Server is the most critical, scored CVSS 9.8 and delivering unauthenticated remote code execution. It should be patched to version 5.6.3 or later before the other four.

Is CVE-2021-3199 being exploited, and how do I fix it?

Yes. CISA, the FBI, and the NSA confirmed active exploitation by a China-linked actor on 08 October 2026. Upgrade ONLYOFFICE Document Server to version 5.6.3 or later; there is no configuration workaround.

Is CVE-2015-3306 still a real risk in 2026?

Yes. It was named as actively exploited in an 08 October 2026 joint advisory, eleven years after its 2015 disclosure, with a public Metasploit module available throughout that time. The risk is any forgotten ProFTPD 1.3.5 instance with mod_copy still enabled.

How many vulnerabilities did CISA add to KEV this week?

Five, all on 08 October 2026, all tied to the same nation-state campaign described in advisory AA26-281A.

What is Flax Typhoon and why does this week’s advisory matter?

Flax Typhoon is a China-linked threat actor tied to the Beijing-based Integrity Technology Group. The 08 October 2026 joint advisory from the FBI, CISA, the NSA, and six allied nations describes the group using a scanning tool to find and exploit vulnerabilities dating back to 2014 inside government, healthcare, manufacturing, and IT networks, alongside an FBI domain seizure targeting the group’s infrastructure.

How should I decide what to patch first when CISA adds multiple CVEs at once?

Rank by exploitation status first, since every KEV entry is already confirmed exploited. Then rank by external reachability: a flaw reachable without authentication on an internet-facing system outranks one needing internal access or privileges. CVSS comes third, as a tie-breaker within those two filters, which is why CVE-2021-3199 outranks the maximum-severity CVE-2015-3306 this week despite ProFTPD’s older score being numerically higher.