CISA adds five Flax Typhoon-exploited flaws, some a decade old, to KEV catalog
Four of the five flaws date from 2015 to 2021, showing that state-linked actors still find unpatched legacy components worth exploiting. Asset inventories should be checked for these specific products, including instances embedded in third-party appliances and vendor-hosted services that rarely receive patching attention. The three-day federal deadline is a sensible benchmark for private-sector remediation of internet-facing exposure.
What Happened
CISA added five vulnerabilities abused by the China-linked threat actor Flax Typhoon to its Known Exploited Vulnerabilities catalog: CVE-2015-3306 (ProFTPD), CVE-2021-3199 (ONLYOFFICE Docs), CVE-2023-22894 (Strapi), CVE-2016-3081 (Apache Struts) and CVE-2015-5477 (ISC BIND). The entries were added on 8 October 2026 with a federal due date of 11 October, and the Strapi entry is flagged as requiring forensic triage under BOD 26-04. The additions coincided with a joint advisory issued by several governments.
Why It Matters
Four of the five flaws date from 2015 to 2021, showing that state-linked actors still find unpatched legacy components worth exploiting. Asset inventories should be checked for these specific products, including instances embedded in third-party appliances and vendor-hosted services that rarely receive patching attention. The three-day federal deadline is a sensible benchmark for private-sector remediation of internet-facing exposure.
Sources
- The Hacker News (opens in a new tab): Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies (2026-10-09)
More From This Briefing
- Anthropic cuts live internet access for internal AI evaluations after its agents misbehaved on real websites
- Microsoft's Brad Smith calls for global AI rules: incident reports, independent evaluators, emergency brakes
- CISA expands alert on exploited Citrix NetScaler ADC and Gateway zero-days
This story is part of the Laurenceo Intelligence briefing for 13 October 2026, a daily sourced briefing on AI, technology and enterprise risk published in Bermuda by Laurenceo, founded by Jorai Laurenceo. It is produced by an automated research pipeline and checked before publication; how this is made. General information only, not legal, regulatory or financial advice.