The U.S. Cybersecurity and Infrastructure Security Agency has placed five security flaws on its Known Exploited Vulnerabilities catalog after the China-linked hacking operation Flax Typhoon weaponized them to infiltrate networks and extract sensitive information, according to a joint advisory released Thursday by Australia, Canada, Japan, New Zealand, Spain, the U.K., and the U.S. Federal agencies now face an Oct. 11, 2026 deadline to apply fixes or discontinue the vulnerable products under CISA's Binding Operational Directive 22-01. The advisory also names Integrity Technology Group, a Chinese cybersecurity firm whose infrastructure supports the attacks.
All five newly cataloged vulnerabilities carry serious severity ratings, and several have existed publicly for years, making the lack of remediation across government systems particularly striking. CVE-2015-3306 in ProFTPD scores a perfect 10.0 on the CVSS scale, allowing any unauthenticated attacker who can contact a vulnerable server to read and write arbitrary files through the site cpfr and site cpto commands. CVE-2021-3199 in ONLYOFFICE Docs, rated 9.8, enables remote code execution when attackers insert a /../ sequence into an image upload parameter in deployments using JSON Web Token authentication. CVE-2023-22894 in Strapi, scored at 7.2, stores sensitive data in cleartext so anyone with admin panel access can retrieve private user information through the query filter. CVE-2016-3081 in Apache Struts, rated 8.1, runs arbitrary code via the method:prefix parameter when Dynamic Method Invocation is turned on, a configuration still active in decade-old Struts installations despite shipping disabled by default. CVE-2015-5477 in ISC BIND, with a 7.5 score, lets remote attackers crash DNS resolvers using specially crafted TKEY queries. The eight-vulnerability advisory also covers three older flaws already in the KEV catalog: CVE-2014-6278, the GNU Bash command injection known as Shellshock, listed in October 2025; CVE-2019-11510, an arbitrary file read in Ivanti Pulse Connect Secure, added in November 2021; and CVE-2021-22205, a remote code execution weakness in GitLab, also added in November 2021.
The joint advisory describes the attack sequence: Flax Typhoon operators search for vulnerable internet-facing systems, then layer exploitation with cross-site scripting and password spraying against Microsoft Exchange servers to establish initial entry. After breaching a network, they deploy VPN software to maintain access and execute scripts that collect email and credentials. "Chinese government-affiliated actors continue to position themselves within critical infrastructure networks, including operational technology (OT) systems, with the aim of disrupting critical functions at a future time of their choosing," said Chris Butera, acting executive assistant director for cybersecurity at CISA. The agencies state that the objective is sustained access to critical infrastructure networks, including operational technology systems controlling physical equipment.
The recurring theme across all eight flaws is outdated software exposed to the internet. ProFTPD from 2015, Struts from 2016, Shellshock from 2014—these are applications many institutions retired on record while servers continued operating in forgotten corners and cloud environments. Flax Typhoon chains these aging, overlooked bugs with weak Exchange configurations, according to the advisory, demonstrating how rarely a campaign relies on a single vulnerability. The exposure of Integrity Technology Group in the advisory provides defenders something unusual in state-sponsored espionage: identified infrastructure to block.
While the Oct. 11 deadline applies only to federal agencies, the advisories offer any organization a concrete action plan. First, conduct an inventory sweep for ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and BIND; if a system runs these products on an internet-reachable interface, treat it as urgent and either patch to the corrected version or shut it down. Second, search for the access methods the advisory outlines: unauthorized VPN appliances, unfamiliar scheduled tasks on Microsoft Exchange servers, and authentication logs showing password spraying patterns—bursts of failed logins against one account or many accounts targeted from a single source in brief time windows. Third, prepare for the catalog to expand, since CISA's Binding Operational Directive 22-01 compels agencies to fix listed vulnerabilities on a fixed timeline, and the Flax Typhoon additions demonstrate that threat groups rarely depend on just one flaw. The CISA KEV catalog and Thursday's joint advisory contain complete technical specifications, including indicators of compromise, giving defenders exactly which doors to lock. For organizations still running legacy systems on public networks, the line between acceptable risk and active compromise has effectively disappeared—particularly when adversaries are already inside similar environments waiting for the moment to act.