Audience: Vulnerability Managers, Security Operations, CISOs, DevSecOps Teams
Reading Time: Approximately 10 minutes

Subscribe to get these articles directly to your inbox when published

6 new KEV additions. Critical flaws in ISC BIND, Apache Struts, ProFTPD, and Citrix NetScaler.

This Week's KEV Additions

Note: EPSS scores are as published by FIRST.org at time of writing and are not updated after publication; scores change daily.

Analysis

CVE-2015-5477 — ISC BIND

• What it is: ISC BIND contains a data processing error vulnerability that could allow remote attackers to cause a denial of service via crafted TKEY queries.

• Affected versions: BIND 9.x prior to 9.9.7-P2 and 9.10.2-P3

• Exploitation status: Confirmed active exploitation (CISA KEV)

• Patch available: Yes, upgrade to patched BIND versions provided by vendor.

• CISA due date: 2026-10-29

• Operational risk: Disrupts core DNS name resolution infrastructure, leading to widespread service outages across enterprise networks.

CVE-2016-3081 — Apache Struts

• What it is: Apache Struts contains a command injection vulnerability allowing remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.

• Affected versions: Struts 2.0.0 through 2.3.24

• Exploitation status: Confirmed active exploitation (CISA KEV)

• Patch available: Yes, upgrade to Struts 2.3.28 or later.

• CISA due date: 2026-10-29

• Operational risk: Grants unauthenticated remote actors arbitrary system command execution privileges on web application servers hosting Java frameworks.

CVE-2023-22894 — Strapi

• What it is: Strapi contains a cleartext storage of sensitive information vulnerability that allows authenticated attackers with access to the admin panel to discover sensitive user details via query filters.

• Affected versions: Strapi versions prior to 4.6.0

• Exploitation status: Confirmed active exploitation (CISA KEV)

• Patch available: Yes, upgrade to Strapi 4.6.0 or higher.

• CISA due date: 2026-10-29

• Operational risk: Exposes confidential account credentials and internal system details to privileged interface users and downstream threat actors.

CVE-2021-3199 — ONLYOFFICE Docs

• What it is: ONLYOFFICE Docs contains a path traversal vulnerability occurring when JWT is used via a /.. sequence in image upload parameters, leading to remote code execution.

• Affected versions: ONLYOFFICE Docs prior to 6.2.0

• Exploitation status: Confirmed active exploitation (CISA KEV)

• Patch available: Yes, upgrade to version 6.2.0 or later.

• CISA due date: 2026-10-29

• Operational risk: Compromises collaborative document servers, allowing attackers to upload malicious payloads and execute arbitrary code on internal hosts.

CVE-2015-3306 — ProFTPD

• What it is: ProFTPD contains an improper access control vulnerability in the mod_copy module that allows remote attackers to read and write arbitrary files via site cpfr and site cpto commands.

• Affected versions: ProFTPD 1.3.5 and prior

• Exploitation status: Confirmed active exploitation (CISA KEV)

• Patch available: Yes, upgrade to ProFTPD 1.3.5a or apply vendor mitigation.

• CISA due date: 2026-10-29

• Operational risk: Enables unauthenticated attackers to write web shells or modify system configuration files, achieving full host compromise.

CVE-2026-88779 — Citrix NetScaler

• What it is: Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service.

• Affected versions: Vulnerable NetScaler ADC and Gateway firmware builds as specified in vendor bulletins.

• Exploitation status: Confirmed active exploitation (CISA KEV)

• Patch available: Yes, apply vendor firmware updates immediately.

• CISA due date: 2026-10-25

• Operational risk: Threatens perimeter security gateways and remote access endpoints, risking complete enterprise perimeter compromise.

Exploitation Context

This week's CISA KEV additions illustrate a prominent trend of automated exploit scanners aggressively targeting legacy and long-tail network services. Flaws such as ProFTPD's mod_copy vulnerability (CVE-2015-3306) and ISC BIND's TKEY query denial of service (CVE-2015-5477) continue to record near-maximum EPSS percentiles (99.50% and 99.41% respectively), demonstrating that threat actors maintain robust, automated tooling for infrastructure components deployed years ago.

Simultaneously, enterprise edge presence remains a primary battlefield, with Citrix NetScaler (CVE-2026-88779) and modern collaboration tools like ONLYOFFICE Docs (CVE-2021-3199) and Strapi (CVE-2023-22894) presenting critical entry vectors. Adversaries are actively combining historical file-handling weaknesses with perimeter gateway flaws to establish persistent footholds across corporate networks.

Remediation Priorities

Detection and Monitoring Guidance

• CVE-2015-5477 (ISC BIND):

  • Log Sources: DNS server query logs, named process logs.

  • Behavioral Indicators: Abnormal volume of malformed TKEY query requests causing daemon crashes or high CPU utilization.

  • Monitoring Gap / Detection Artifacts: Unmonitored internal DNS servers lacking recursive query rate-limiting.

• CVE-2016-3081 (Apache Struts):

  • Log Sources: Web server access logs, application server error logs.

  • Behavioral Indicators: HTTP requests containing method:prefix parameters designed to invoke unauthorized Java methods.

  • Monitoring Gap / Detection Artifacts: Lack of deep packet inspection or WAF rules blocking Dynamic Method Invocation payloads.

• CVE-2023-22894 (Strapi):

  • Log Sources: Strapi admin audit logs, API query logs.

  • Behavioral Indicators: Unauthorized administrative queries requesting sensitive user attribute filters.

  • Monitoring Gap / Detection Artifacts: Insufficient role-based access logging on backend query endpoints.

• CVE-2021-3199 (ONLYOFFICE Docs):

  • Log Sources: Document server access logs, file upload directories.

  • Behavioral Indicators: HTTP upload requests containing traversal sequences (/../) in image parameter paths.

  • Monitoring Gap / Detection Artifacts: Unrestricted file upload storage locations lacking input sanitization.

• CVE-2015-3306 (ProFTPD):

  • Log Sources: ProFTPD daemon logs, system file integrity monitoring (FIM).

  • Behavioral Indicators: Unauthenticated execution of site cpfr and site cpto FTP commands targeting system binaries or web directories.

  • Monitoring Gap / Detection Artifacts: Legacy FTP servers operating without active command auditing or FIM agents.

• CVE-2026-88779 (Citrix NetScaler):

  • Log Sources: NetScaler system logs, authentication gateway telemetry.

  • Behavioral Indicators: Unexpected gateway crashes, core dumps, or anomalous traffic patterns targeting buffer limits.

  • Monitoring Gap / Detection Artifacts: Lack of real-time telemetry on edge proxy memory consumption and error states.

Hackerstorm Analysis

The resurgence of vintage vulnerabilities in CISA's KEV catalog underscores a critical reality of modern threat intelligence: adversaries do not discriminate based on publication year. With EPSS probabilities exceeding 99% for legacy flaws like ProFTPD and ISC BIND, automated exploitation frameworks continuously sweep the internet for unpatched infrastructure. Security teams must recognize that perimeter resilience depends as much on legacy asset hygiene and comprehensive inventory tracking as it does on adopting zero-day defenses.

What you should do next

Ensure you understand the latest KEV additions to cover off any potential gaps in your remediation activities.  View all weekly reports here

Further Reading

The following resources offer technical analysis to help integrate CISA KEV data into operational triage workflows and stay aligned with updated mitigation guidance.

About This Report

Attribution Note

This analysis is based on publicly available reporting and security research summaries. Some technical details may change as additional information becomes available. 

Author Information

Timur Mehmet | Founder & Lead Editor

Timur is a veteran Information Security professional with a career spanning over three decades. Since the 1990s, he has led security initiatives across high-stakes sectors, including Finance, Telecommunications, Media, and Energy. Professional qualifications over the years have included CISSP, ISO27000 Auditor, ITIL and technologies such as Networking, Operating Systems, PKI, Firewalls. For more information including independent citations and credentials, visit our About page.

Contact: This email address is being protected from spambots. You need JavaScript enabled to view it.

Editorial Standards

This article adheres to Hackerstorm.com's commitment to accuracy, independence, and transparency:

• Fact-Checking: All statistics and claims are verified against primary sources and authoritative reports
• Source Transparency: Original research sources and citations are provided in the References section below
• No Conflicts of Interest: This analysis is independent and not sponsored by any vendor or organization
• Corrections Policy: We correct errors promptly and transparently. Report inaccuracies to This email address is being protected from spambots. You need JavaScript enabled to view it.

Editorial Policy: Ethics, Non-Bias, Fact Checking and Corrections

Learn More: About Hackerstorm.com | FAQs

Source Transparency

• CVE-2015-5477:

  • NVD (NVD) — https://nvd.nist.gov/vuln/detail/CVE-2015-5477

  • ISC Knowledge Base (Vendor advisory) — https://kb.isc.org/docs/aa-01272

• CVE-2016-3081:

  • NVD (NVD) — https://nvd.nist.gov/vuln/detail/CVE-2016-3081

  • Apache Software Foundation (Vendor advisory) — https://cwiki.apache.org/confluence/display/WW/S2-032

• CVE-2023-22894:

  • NVD (NVD) — https://nvd.nist.gov/vuln/detail/CVE-2023-22894

  • Strapi GitHub Security Advisories (Vendor advisory) — https://github.com/strapi/strapi/security/advisories

• CVE-2021-3199:

  • NVD (NVD) — https://nvd.nist.gov/vuln/detail/CVE-2021-3199

  • ONLYOFFICE GitHub Repository (Vendor advisory) — https://github.com/ONLYOFFICE/DocumentServer

• CVE-2015-3306:

  • NVD (NVD) — https://nvd.nist.gov/vuln/detail/CVE-2015-3306

  • ProFTPD Project (Vendor advisory) — https://github.com/proftpd/proftpd

• CVE-2026-88779:

  • NVD (NVD) — https://nvd.nist.gov/vuln/detail/CVE-2026-88779

  • Citrix Support (Vendor advisory) — https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

Analyst Notes

• No ransomware attribution was publicly associated with this week's KEV additions at the time of publication.
• No confirmed threat actor attribution was available beyond CISA's confirmation of active exploitation for the majority of entries.
• Where vendor advisory details or EPSS values were unavailable at publication time, placeholders were retained pending analyst validation and vendor updates prior to final publication.