CISA Adds Five Longstanding Actively Exploited Vulnerabilities to the KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has updated its Known Exploited Vulnerabilities (KEV) Catalog, adding five significant security flaws. The vulnerabilities include an access control flaw in ProFTPD (CVE-2015-3306), a path traversal bug in ONLYOFFICE Docs (CVE-2021-3199), and command injection issues in Apache Struts (CVE-2016-3081). The list also includes cleartext information exposure in Strapi (CVE-2023-22894) and a critical weakness affecting the ISC BIND DNS server (CVE-2015-5477). CISA’s decision highlights how malicious actors continue to successfully exploit even older flaws to breach inadequately patched corporate environments. U.S. federal agencies and organizations worldwide are instructed to apply the recommended patches or mitigations within tight deadlines to prevent intrusions. Failure to promptly update these components exposes critical infrastructure to the risk of remote code execution and persistent data theft.

Source: Security Affairs