CISA adds five flaws aged three to eleven years to KEV, led by ProFTPD at CVSS 10.0 and EPSS 97%
On October 8, 2026, CISA added five vulnerabilities dated 2015 to 2023 — ProFTPD, ISC BIND, Apache Struts, ONLYOFFICE and Strapi — to its Known Exploited Vulnerabilities catalog, all now actively exploited. A CVE’s age is no longer an excuse to leave it open: audit your legacy estate before these old bugs become your next breach.