CISA adds five flaws aged three to eleven years to KEV, led by ProFTPD at CVSS 10.0 and EPSS 97%
On October 8, 2026, CISA added five vulnerabilities dated 2015 to 2023 — ProFTPD, ISC BIND, Apache Struts, ONLYOFFICE and Strapi — to its Known Exploited Vulnerabilities catalog, all now actively exploited. A CVE’s age is no longer an excuse to leave it open: audit your legacy estate before these old bugs become your next breach.
October 8, 2026. CISA updates its Known Exploited Vulnerabilities (KEV) catalog and adds five flaws dated 2015 to 2023. CVE-2015-3306. That is the hottest one: an eleven-year-old ProFTPD flaw rated CVSS 10.0 with a 97% EPSS. Why it matters: these bugs have been forgotten by nearly everyone, and they are now actively exploited — proof that attackers are sweeping the legacy assets teams stopped patching.
Five flaws, three to eleven years old
The distinctive feature of this batch is its age. A KEV addition means CISA has confirmation of real-world exploitation. Here, five vulnerabilities long off the radar are back in the spotlight.
- CVE-2015-3306 — ProFTPD, dated 2015. An access-control defect lets a remote attacker read and write arbitrary files through the
site cpfrandsite cptocommands. Rated CVSS 10.0, with a 97% EPSS: the most likely of the batch to be exploited within thirty days, according to FIRST. - CVE-2015-5477 — ISC BIND, dated 2015. A data-processing error allows a denial of service through TKEY queries. Rated CVSS 7.5, EPSS 91%.
- CVE-2016-3081 — Apache Struts, dated 2016. A command injection via
method:prefixwhen Dynamic Method Invocation is enabled. Rated CVSS 8.1, EPSS 93%. - CVE-2021-3199 — ONLYOFFICE Docs, dated 2021. A path traversal via a
/..sequence in an image upload parameter enables remote code execution. Rated CVSS 9.8. - CVE-2023-22894 — Strapi, dated 2023. Cleartext storage of sensitive information, chainable with CVE-2023-22621 to reach RCE. Rated CVSS 4.9.
The common thread is not technical but strategic: none of these flaws is recent, and yet all of them are being exploited right now.
ProFTPD, the hottest of the batch
CVE-2015-3306 deserves a closer look, because it illustrates the phenomenon on its own. The flaw sits in the mod_copy module of ProFTPD, the FTP server widely distributed across Linux and hosting environments.
In practice, the site cpfr and site cpto commands allow a file to be copied without proper prior authentication. An attacker who reaches the service can thus read sensitive files — keys, passwords, source code — or write to arbitrary filesystem locations, depending on the process’s permissions. On an exposed FTP server, that is often a direct path to compromise.
The 97% EPSS score is the most telling signal. EPSS measures the probability that a CVE will be exploited within the next thirty days, independent of raw severity. A 97% on a 2015 flaw means attackers are actively scanning that specific service and have working tooling. This is no longer a theoretical vulnerability: it is an asset under pressure.
Why CISA adds 2015 bugs in 2026
KEV additions follow a strict rule: CISA only lists flaws with confirmed real-world exploitation. The arrival of vulnerabilities from 2015, 2016 and 2021 in 2026 therefore says something precise about the threat landscape.
Attackers are industrializing the hunt for forgotten assets. Legacy FTP services, unmigrated DNS servers, historical Struts applications and left-behind CMS instances make an ideal target: rarely inventoried, almost never patched, and often exposed on network ranges teams stopped watching. For an attacker, the effort-to-reward ratio is excellent.
The corollary is that a CVE’s age is no longer a prioritization criterion. For years, the reflex was to address recent flaws first and relegate old ones to the bottom of the debt pile. This KEV batch invalidates that reflex: a 2015 flaw with a 97% EPSS must jump ahead of a recent but unexploited one.
There is a broader signal here too. The KEV catalog has grown past 1,300 entries, and CISA is increasingly back-filling it with vulnerabilities that predate the catalog itself — evidence that attackers keep recycling proven exploits against the long tail of unpatched infrastructure. FIRST’s EPSS exists to quantify exactly that recycling: it scores exploitation probability from real-world telemetry rather than a static severity formula, which is why an eleven-year-old ProFTPD bug can outrank a brand-new CVE. For a defender, the practical reading is uncomfortable: a legacy service you have not touched in years is not “stable”, it is a target — and the only way to know which old bugs attackers care about is to watch KEV and EPSS, not to assume age equals safety.
What it changes for your triage
The operational takeaway comes down to three moves.
- Look for these five components in your estate. ProFTPD, ISC BIND, Apache Struts, ONLYOFFICE and Strapi are not niche products: they tend to linger in forgotten corners of infrastructure. A targeted inventory scan beats a blind list of patches.
- Prioritize by exploitation, not age. A high EPSS on an old flaw signals immediate risk. If you still run one of these services, the question is not “how severe is it?” but “is it still reachable from the network?”.
- Patch, or retire the service. For ProFTPD, BIND and Struts, fixes have existed for years; if they were never applied, that is the signature of an ungoverned asset. For end-of-life products, the clean exit is decommissioning.
U.S. federal civilian agencies face a hard deadline: CISA requires FCEB agencies to remediate KEV entries on a short clock — a pressure that explains why this catalog has become the triage reference for security teams worldwide.
What each fix actually demands
Beyond triage, each flaw calls for a precise response.
For ProFTPD, the fix is to move to a recent release or, better, to disable mod_copy — the faulty module — and to restrict access to the service behind authentication and a firewall. A public FTP server in 2026 is an anomaly anyway: if the need is file transfer, SFTP or FTPS are the answer.
For ISC BIND, the exit is an upgrade to a supported branch; since the TKEY flaw is a denial of service, exposure depends mostly on whether the DNS service is reachable from outside. A properly isolated internal resolver is already out of reach.
For Apache Struts, the stakes are double: patch the version, and above all disable Dynamic Method Invocation if it is still enabled — it is what makes the injection possible, and it has no reason to be active on a modern deployment.
For ONLYOFFICE and Strapi, the logic is the same: upgrade to the fixed version and check that the instance is not publicly exposed. These are products often deployed “internally” without supervision, which makes them all the more dangerous once compromised.
The common lesson: on these five flaws, the fix has existed for years. What was missing was not a patch, but an inventory.
Verdict
If one of these five components still runs in your infrastructure, do not sweep it under the rug on the grounds that these are “old flaws”: a 97% EPSS on ProFTPD and exploitation confirmed by CISA make it an immediate risk, not technical debt. Check reachability from the network first, then apply the patch — or retire the service if it is end-of-life. If none of these products is present in your environment, the real lesson still holds: fold EPSS and the KEV into your triage, and periodically reassess the old flaws you once set aside — those are precisely the ones attackers are exploiting today.