CISA Adds Five Legacy Flaws with a Three-Day Patch Deadline, Forcing an Asset Inventory

CISA Adds Five Legacy Flaws at Once, Turning a Patch List into an Asset Inventory Task

CISA's Known Exploited Vulnerabilities (KEV) catalog is essentially a "deadline engine": each entry states the vulnerability, the affected product, the date it was added, and the final deadline by which U.S. federal agencies must remediate or discontinue use of the product. On October 8, this engine added five vulnerabilities at once, each with a three-day window and a deadline of October 11 — and for most of them, fixes have been available for years.

According to analysis by the security research firm Suriq, the entire batch can be summed up in one sentence: "The real news isn't another zero-day." Four of the five vulnerabilities were disclosed between 2015 and 2021, yet CISA still gave them a three-day response window. That posture only emerges when an agency is confronting actual exploitation happening right now.

One more detail: on the same day, the FBI, CISA, and NSA jointly published security advisory AA26-281A, pointing to a Chinese company providing support for large-scale scanning operations; the U.S. Department of Justice also announced the seizure of seven domains, which hosted a Python scanner and a malware delivery system. Catalog updates usually appear on their own, but these five vulnerabilities arrived alongside a larger document — one that explains why old flaws are being pushed back onto the deadline list.

The CISA KEV catalog is the "Known Exploited Vulnerabilities" catalog maintained by the U.S. Cybersecurity and Infrastructure Security Agency. What sets it apart from ordinary vulnerability databases is its inclusion threshold: only vulnerabilities confirmed to be actively exploited in the wild make it in, and each entry carries an explicit remediation deadline. Under Binding Operational Directive (BOD 22-01), U.S. federal civilian executive branch agencies must remediate or discontinue use of affected products by the deadline. Because federal agencies must comply and the private sector widely references the catalog for prioritization, KEV has effectively become the baton that sets the global pace of vulnerability remediation. Re-adding old vulnerabilities with a tight three-day window usually means intelligence has confirmed active exploitation is occurring, rather than being a purely preventive recommendation.

Five Vulnerabilities Point to a Typical Mid-Sized Server Estate

Viewed together, these five vulnerabilities sketch out a typical mid-sized server estate: a DNS resolver, a file transfer server, a Java application server, a document collaboration service, and a CMS. Suriq listed them in one sentence as "a DNS daemon, an FTP server, a web framework, a document server, and a headless content system."

By severity as recorded in KEV reports: ProFTPD's file read/write vulnerability scores 10.0, ONLYOFFICE Docs' path traversal 9.8, Apache Struts' command injection 8.1, BIND's denial of service 7.5, and Strapi's cleartext exposure 7.2. Two of these are naturally internet-facing in most deployments, and DNS resolvers are often the one least likely to be written into an asset inventory.

As for how each vulnerability is exploited: ProFTPD's access control flaw allows a remote attacker to read and write arbitrary files through the two commands site cpfr and site cpto (CWE-284), and a fix has existed since 2015. Apache Struts' command injection depends on a Dynamic Method Invocation configuration switch — the vulnerability's actual blast radius comes down to a configuration decision someone made years ago. Strapi's flaw requires admin panel access to filter private fields, and CISA notes that affected versions may already be end-of-life; for those instances, "patching" as a path no longer exists. ONLYOFFICE's path traversal can reach code execution, while BIND's denial of service causes the resolver process to repeatedly crash and restart.

The Joint Advisory Reveals Why Old Vulnerabilities Are Returning

The joint advisory AA26-281A describes the attackers as "cyber threat actors associated with the Chinese government, leveraging capabilities provided by Integrity Technology Group," who "are combining automated scanning tools, large-scale botnets, and manual penetration techniques to steal sensitive data from organizations worldwide, including U.S. critical infrastructure sectors."

Scanning is the first verb in that passage, and scanning is precisely the step that turns an unattended service into a security incident. The technical details listed in the advisory are worth reading twice: cross-site scripting and password spraying against Microsoft Exchange servers, establishing persistence through VPN software, and exfiltrating mail and credentials through scripts. Its mitigation recommendations are plain to the point of being mundane — prioritize disabling unused services and ports, sanitize web application input, enable multi-factor authentication for all services, and patch promptly.

Suriq's report ties the two documents together and adds the law enforcement angle: the Department of Justice announced the seizure that day of seven domains hosting "a Python scanner called MicroScan and a malware delivery system called FishHub." The scanner reportedly "carries over 1,300 penetration testing scripts, including detection for old issues like the 2014 Shellshock vulnerability." A scanner loaded with 1,300-odd pieces of "ammunition" going up against services that should have been upgraded years ago but never were — that's the complete causal chain behind old vulnerabilities reappearing on the deadline list.

Shellshock (CVE-2014-6271) is a remote code execution vulnerability in the Bash shell disclosed in 2014, affecting Linux and Unix systems. Attackers can craft special environment variables that cause Bash to execute arbitrary commands while parsing function definitions. What makes it distinctive is its enormous reach: CGI scripts, DHCP clients, some SSH configurations, and even embedded devices can serve as entry points, and the exploitation barrier is extremely low. Because Bash is nearly ubiquitous, Shellshock has been called an event on the scale of Heartbleed. For attackers, its value lies in this — even if the target system has since been updated, any legacy asset still running a version of Bash from around 2014 can be hit by the same payload, so it has long resided in the "ammunition depots" of automated scanners and is a classic sample for gauging the threat of old vulnerabilities.

The Patch List Assumes Something Only an Asset Inventory Can Answer

A patch list carries an implicit assumption: you know where the software is running. October's batch offers no such guarantee, and the age of the vulnerabilities is precisely why — a BIND resolver installed with a distribution back in 2016 sits in some configuration management record that hasn't been updated since the day the service started running normally.

The order of operations follows from this. Step one: enumerate every service answering on external addresses, then compare the results against these five products, including versions buried in device firmware. Step two: for each hit, find the fixed version: BIND 9.9.7-P2 or 9.10.2-P3 and later, ProFTPD 1.3.5a or simply disable mod_copy, Apache Struts 2.3.20.3/2.3.24.3/2.3.28.1, ONLYOFFICE 5.6.3 and later, Strapi 4.8.0 and later — while remembering that affected Strapi versions may be end-of-life and should go on a retirement list rather than a patch queue.

Anything that can't be upgraded within the window should be pulled off the public internet or placed behind authentication. And this batch requires more than a single version check: four of the five vulnerabilities carry forensic triage flags, meaning you must look for signs of use before closing the ticket — unusual files, newly created accounts, web shells, and outbound connections.

The forensic triage flag is an easily overlooked field in the KEV catalog. It indicates that the vulnerability was very likely actually exploited, so before the ticket is closed, in addition to patching the version, you must search the affected host for signs of intrusion. Typical triage targets include unusual newly created files, scheduled tasks or startup items, unauthorized accounts, web shells, and outbound connection activity. KEV entries carrying this kind of flag often correspond to higher-confidence intelligence about exploitation in the wild. Because once attackers get in through an old vulnerability, they usually leave persistence backdoors in the system — upgrading the software alone does not equal removing the intrusion, which is exactly why federal agencies are required to "look for traces first, then close the ticket."

Three Checks Before October 11

The work can be broken into three checks that fit within this window.

The first is an exposure check: determine which of these five services accept connections from outside, and count the DNS resolvers and file transfer hosts actually reachable from the internet — rather than counting them off an architecture diagram.

The second is cleanup: if a service exists only for a workflow nobody uses anymore, retire it outright, wiping out the problem and the maintenance obligation in one move — FTP servers are the easiest candidates. If the service is load-bearing, follow the upgrade paths above, in whatever order keeps services responding continuously.

The third is log investigation, and it varies by product: ProFTPD leaves site cpfr and site cpto commands in its own logs; Struts shows method prefixes on .action requests; ONLYOFFICE records upload parameters containing traversal sequences; Strapi shows abnormal query filters. BIND's denial of service leaves almost no trace, so the signal to alert on is the named process dying and restarting. If credentials or tokens passed through an exposed instance, the investigation should be followed by rotation, and Strapi's guidance also calls for resetting admin credentials and password reset tokens after upgrading.

What Will Outlast This Batch of CVEs

October's batch will be closed out, and the next one will arrive in the same shape, because the underlying mechanism doesn't change with CVE numbers. Industrialized scanners find unattended software, and unattended software piles up exactly where organizations stop paying attention: resolvers, transfer hosts, application servers that were never redeployed after the project went live.

Two habits can shorten the next cycle. First, maintain a list of services currently answering on public addresses, with an owner and a review date for each — because the most time-consuming discovery is always the service missing from the list. Second, treat end-of-life software as a planned retirement rather than a patch backlog item, because a build with no supported version simply cannot be fixed within a single window.

The five vulnerabilities from October 8 are themselves unremarkable. What makes them worth acting on is the evidence CISA published alongside them: a scanner loaded with over 1,300 exploit scripts, a set of three-day deadlines aimed at vulnerabilities from 2015, and a public list naming specific services for you to check. An asset inventory fills precisely this gap, and it's far faster than planning a patch cycle around a version list you can't trust.

One-line Summary

CISA added five legacy flaws to KEV with a three-day deadline, showing an asset inventory matters more than a patch plan.

Paragraph Summary

On October 8, CISA added five legacy flaws to its Known Exploited Vulnerabilities catalog at once, setting a uniform October 11 deadline; four were disclosed between 2015 and 2021. The five cover BIND, ProFTPD, Apache Struts, ONLYOFFICE Docs, and Strapi, with severity ranging from 7.2 to 10.0. The same-day joint advisory AA26-281A points to large-scale scanning activity backed by Integrity Technology Group, and the DOJ seized seven related domains. The article argues that old flaws resurface because unattended services pile up where organizations stop paying attention — such as DNS resolvers, FTP hosts, and legacy application servers — so asset inventory, meaning enumerating publicly reachable services and checking their versions, is more effective than planning a patch cycle around an untrustworthy version list.