Loading story…
CISA added five vulnerabilities affecting ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND to its Known Exploited Vulnerabilities catalog following reported exploitation linked to China-linked Flax Typhoon and Integrity Technology Group. Federal civilian executive branch agencies must patch affected systems or discontinue their use by October 11, 2026. A joint advisory from seven countries described operations exploiting eight vulnerabilities to gain initial access and steal sensitive information, alongside vulnerability scanning, Microsoft Exchange password spraying, VPN-based persistence, and scripted theft of emails and credentials. The U.S. Department of Justice and FBI also seized Microscan and FishHub, tools allegedly used for vulnerability scanning and spear-phishing-enabled compromise.
The listed flaws include CVE-2015-3306, which permits arbitrary file reads and writes through ProFTPD 1.3.5’s mod_copy module; CVE-2021-3199, a directory-traversal flaw that can lead to remote code execution in ONLYOFFICE Document Server before 5.6.3 when JWT is used; and CVE-2023-22894, which allows attackers with Strapi admin-panel access to infer sensitive user data in versions through 4.5.5, with exposure depending on account permissions. Brazil’s CTIR Gov separately urged immediate patching of CVE-2016-3081, a critical Apache Struts remote-code-execution vulnerability. The ISC BIND flaw can cause denial of service. Organizations should prioritize identifying affected deployments and applying vendor fixes, including outside the federal sector, given the reported exploitation.
See which actors are running it and whether you're in range.
13 events from the most recent confirmed update back to the earliest known activity.
CTIR Gov published Alert 92/2026 warning that CVE-2016-3081 could allow remote arbitrary code execution and was listed in CISA's KEV catalog. It urged institutions to identify vulnerable deployments and immediately apply developer-provided fixes.
CISA added the GNU Bash command-injection vulnerability CVE-2014-6278 to its KEV catalog. The Shellshock-associated flaw was later identified as another vulnerability targeted in the reported operations.
The CVE-2023-22894 record was published, documenting sensitive-information disclosure in Strapi through version 4.5.5. Attackers with admin-panel access can infer sensitive user-data values through crafted query filters; super administrators can recover password hashes and password reset tokens for all users.
CISA added CVE-2019-11510, an arbitrary file-read vulnerability in Ivanti Pulse Connect Secure, and CVE-2021-22205, a GitLab remote code-execution vulnerability, to its KEV catalog. Both were subsequently identified among the eight vulnerabilities targeted in the reported China-linked operations.
The CVE-2021-3199 record was published, describing directory traversal that can lead to remote code execution in ONLYOFFICE Document Server versions before 5.6.3. The flaw affects the /upload endpoint when JWT is used.
MITRE published CVE-2015-3306, documenting a flaw in ProFTPD 1.3.5's mod_copy module. Remote attackers can use SITE CPFR and SITE CPTO commands to read and write arbitrary files.
CSIRT Panamá issued a public bulletin warning that CVE-2021-3199 affects ONLYOFFICE Document Server versions 5.1.5–5.6.2 and permits arbitrary file writes potentially leading to remote code execution. It urged upgrading to a supported release, restricting Internet exposure, and investigating possible compromise, providing detection guidance and six file hashes from the joint advisory.
CSIRT Panamá issued an advisory warning that actively exploited CVE-2015-3306 permits unauthenticated file copying in ProFTPD 1.3.5 and can enable remote code execution through webshell placement. It urged organizations to upgrade to a fixed version, disable or restrict mod_copy if patching was unavailable, and investigate signs of compromise.
CISA added CVE-2015-3306, CVE-2021-3199, CVE-2023-22894, CVE-2016-3081, and CVE-2015-5477 to its KEV catalog following exploitation linked to Flax Typhoon. The flaws affect ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND; federal agencies were directed to remediate them or discontinue affected products by October 11, 2026.
Australia, Canada, Japan, New Zealand, Spain, the United Kingdom, and the United States issued a joint advisory warning about operations enabled by Integrity Technology Group. The advisory described exploitation of eight vulnerabilities and warned of China-affiliated actors positioning themselves in critical infrastructure networks, including operational technology systems.
The U.S. Department of Justice and FBI seized Microscan and FishHub, tools allegedly operated by Integrity Technology Group against critical infrastructure and other organizations in multiple countries. Microscan scanned for vulnerable systems, while FishHub used spear-phishing to deliver malware, enable remote access, and steal files.
Reported operations attributed to China-linked actors associated with Integrity Technology Group exploited eight vulnerabilities to gain initial access and steal sensitive information. Activity included scanning, cross-site scripting, Microsoft Exchange password spraying, VPN-based persistence, and scripted theft of emails and credentials.
A security update was published to address CVE-2016-3081, which can allow remote arbitrary code execution in Apache Struts. CTIR Gov confirmed the update's availability but did not identify its release date or fixed version.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
10 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityaffairs.com
Open sourcegov.br
Open sourcethehackernews.com
Open sourcecve.org
Open sourcecve.org
Open sourcecve.org
Open sourcecve.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) Catalog by adding five new security flaws that are currently under active exploitation. The vulnerabilities include CVE-2021-21311 affecting Adminer, CVE-2025-20352 impacting Cisco IOS and IOS XE, CVE-2025-10035 in Fortra GoAnywhere MFT, CVE-2025-59689 in Libraesva Email Security Gateway, and CVE-2025-32463 in Sudo. The Adminer flaw is a Server-Side Request Forgery (SSRF) vulnerability that allows attackers to manipulate URL parameters, potentially enabling unauthorized access to internal resources and facilitating lateral movement within networks. The Cisco IOS and IOS XE vulnerability is a stack-based buffer overflow in the SNMP subsystem, which can be exploited by sending crafted SNMP packets, leading to denial of service or remote code execution as root, depending on attacker privileges. Fortra GoAnywhere MFT is affected by a critical deserialization vulnerability in its License Servlet, which could allow attackers to execute arbitrary code. Libraesva ESG suffers from a command injection vulnerability, and Sudo is impacted by a flaw involving the inclusion of functionality from an untrusted control sphere. CISA’s Product Security Incident Response Team (PSIRT) has confirmed that these vulnerabilities are being actively exploited in the wild. The addition of these flaws to the KEV Catalog is based on credible evidence of exploitation, and CISA has issued a Binding Operational Directive (BOD) 22-01 requiring Federal Civilian Executive Branch (FCEB) agencies to remediate these vulnerabilities by specified deadlines. The directive aims to reduce significant risk to federal networks, but CISA also strongly urges all organizations, not just federal agencies, to prioritize remediation of these vulnerabilities as part of their vulnerability management programs. The vulnerabilities span a range of critical systems, including database management tools, network operating systems, email security gateways, and managed file transfer platforms, highlighting the broad attack surface targeted by malicious actors. The Adminer SSRF vulnerability, with a CVSS score of 7.2, affects versions 4.0.0 to just before 4.7.9, while the Cisco IOS/IOS XE flaw, with a CVSS score of 7.7, impacts all devices with SNMP enabled. The Fortra GoAnywhere MFT vulnerability is rated as critical with a CVSS score of 10.0, underscoring the urgency of remediation. CISA’s ongoing updates to the KEV Catalog reflect the evolving threat landscape and the need for organizations to remain vigilant against actively exploited vulnerabilities. Organizations are encouraged to consult the KEV Catalog regularly and implement timely patches to mitigate the risk of compromise. The inclusion of these vulnerabilities in the KEV Catalog serves as a warning to both public and private sector entities about the heightened risk posed by these flaws. Failure to address these vulnerabilities could result in significant operational disruptions or unauthorized access to sensitive systems. CISA’s alert emphasizes the importance of proactive vulnerability management and cross-sector collaboration to defend against active cyber threats.
Jun 29, 2026
CISA added 14 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog across two updates, citing evidence of active exploitation against widely used enterprise products from Fortinet, Microsoft, Adobe, Cisco, JetBrains, PaperCut, Kentico, Quest, and Zimbra. The newly listed flaws include issues in FortiClient EMS, Adobe Acrobat Reader, Microsoft Windows Common Log File System Driver, Microsoft Exchange Server, Host Process for Windows Tasks, Microsoft Visual Basic for Applications, JetBrains TeamCity, PaperCut NG/MF, Kentico Xperience, Quest KACE SMA, Zimbra Collaboration Suite, and Cisco Catalyst SD-WAN Manager, including privilege escalation, credential exposure, sensitive information disclosure, and cross-site scripting weaknesses. Reporting tied several of the vulnerabilities to real-world intrusion activity and ransomware operations. Microsoft said threat actor **Storm-1175** used `CVE-2023-21529` to deliver **Medusa ransomware**, while `CVE-2023-27351` has been linked to **Lace Tempest** deployments of **Cl0p** and **LockBit**. Defused Cyber also reported exploitation attempts against `CVE-2026-21643`, and CISA said federal civilian agencies must remediate the newly added flaws on deadlines running from late April into May 2026 under Binding Operational Directive requirements, while private-sector defenders were urged to prioritize the KEV entries for patching and exposure reduction.
Jun 29, 2026
CISA repeatedly expanded its **Known Exploited Vulnerabilities (KEV) Catalog** after confirming active exploitation across a wide range of products, including Apple platforms, Ivanti EPM and EPMM, SolarWinds Web Help Desk, Omnissa Workspace ONE, n8n, Google Chromium and Skia, Wing FTP Server, Zimbra, Cisco firewall management products, Langflow, Aqua Security Trivy, F5 BIG-IP, Fortinet FortiClient EMS, Microsoft Exchange, SharePoint, Windows, Defender, Adobe Acrobat/Reader, Apache ActiveMQ, Trend Micro Apex One, Palo Alto PAN-OS, and other enterprise software. Several entries were especially notable because they involved **remote code execution, code injection, deserialization, authentication bypass, privilege escalation, and supply-chain-style malicious code risks**, while CISA also highlighted active exploitation of older legacy Microsoft and Adobe flaws that remain dangerous on unpatched or end-of-life systems. Reporting tied some of the newly listed issues to concrete attack activity and elevated operational risk. Apple flaws added to KEV were reported as exploitable through malicious web content or apps and could lead to arbitrary code execution or kernel-level execution, while the critical Langflow bug `CVE-2025-34291` was described as enabling session hijacking, token theft, persistence, and possible full system compromise in AI workflow deployments; separate reporting said the Iranian threat actor **MuddyWater** used it for initial access. Trend Micro said it observed at least one attempted in-the-wild exploitation of its Apex One flaw, and coverage of Ivanti vulnerabilities warned that defenders should not rely solely on shared indicators of compromise. Under **Binding Operational Directive 22-01**, Federal Civilian Executive Branch agencies were ordered to remediate each KEV-listed flaw by assigned deadlines, and CISA urged all organizations to apply vendor fixes or mitigations immediately and discontinue affected products if no mitigation is available.
Jun 30, 2026