In short: CISA has added five actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after a joint advisory linked them to Flax Typhoon, a China-linked threat actor. The surprising part is their age: most of these bugs date back to 2015 and 2016. U.S. federal agencies had until October 11, 2026 to patch or stop using the affected products, and every other organization exposing these services should treat them as urgent.
Who is Flax Typhoon?
Flax Typhoon is a China-linked cyber-espionage group that has been active since at least 2021. Other security vendors track it as Ethereal Panda and RedJuliett. The group is known for living-off-the-land techniques, quiet long-term persistence and, above all, exploiting known vulnerabilities in internet-facing systems instead of burning zero-days.
The new joint advisory was issued by agencies from Australia, Canada, Japan, New Zealand, Spain, the United Kingdom and the United States. It points to Integrity Technology Group, a China-based security company, as an enabler of the activity. In September 2024, an FBI-led operation disrupted infrastructure tied to the group that had compromised more than 260,000 devices, but the actor has since rebuilt part of its capabilities.
The five vulnerabilities added to KEV
| CVE | Product | CVSS | Issue |
|---|---|---|---|
| CVE-2015-3306 | ProFTPD (mod_copy) | 10.0 | Unauthenticated file read/write through the SITE CPFR and SITE CPTO commands |
| CVE-2021-3199 | ONLYOFFICE Docs | 9.8 | Path traversal in image upload when JWT is used, which can lead to code execution |
| CVE-2016-3081 | Apache Struts | 8.1 | Remote command injection via the method: prefix when Dynamic Method Invocation is enabled |
| CVE-2015-5477 | ISC BIND | 7.5 | Reachable assertion triggered by TKEY queries, causing remote denial of service |
| CVE-2023-22894 | Strapi | 7.2 | Sensitive user data exposed to admin-panel users via query filters (cleartext storage) |
According to the advisory, Flax Typhoon’s activity covers eight vulnerabilities in total. The other three were already in KEV: Shellshock in GNU Bash (CVE-2014-6278), the Ivanti Pulse Connect Secure file read (CVE-2019-11510) and the GitLab CE/EE RCE (CVE-2021-22205).
Observed tactics
- Scanning for and exploiting vulnerable public-facing services, including through cross-site scripting.
- Password spraying against Microsoft Exchange servers.
- Maintaining persistence through VPN software.
- Using scripts to collect and exfiltrate emails and credentials.
U.S. officials warned that Chinese state-affiliated actors are positioning themselves inside critical infrastructure, including operational technology (OT), so they can disrupt it later.
Why decade-old CVEs still matter
Old vulnerabilities survive in forgotten FTP servers, legacy Java applications and unmanaged DNS boxes. Attackers know that asset inventories are rarely complete, so scanning the internet for a ten-year-old bug is cheap and still pays off. This is a good reminder that patch priority should be driven by active exploitation, not by how new or famous a CVE is.
What defenders should do
- Inventory exposed services. Find every internet-facing ProFTPD, ONLYOFFICE, Struts, BIND and Strapi instance. An external scan with a tool like Nmap helps; see our Nmap cheat sheet for service and version detection commands.
- Patch or remove. Upgrade to supported versions, disable ProFTPD’s
mod_copyif you do not need it, and turn off Struts Dynamic Method Invocation. - Harden Exchange authentication. Enforce MFA and monitor for spikes of failed logons across many accounts, a typical password-spraying signal.
- Review VPN and remote-access logs for unfamiliar accounts, devices or login locations.
- Use KEV as a prioritization feed alongside your scanner results and national CERT bulletins.