CISA just added Apache Struts, ProFTPD and three more years-old CVEs to KEV after China-linked hackers exploited them. Are you exposed?
The oldest bug that state-linked hackers were caught exploiting this month was disclosed in 2015. Back then, people were still arguing about whether a dress was blue or gold. On October 8, 2026, CISA added it to its list of vulnerabilities being exploited in the wild, alongside four others aged three to eleven years.
These attackers aren't going after anything new. They keep a big automated catalogue of old exploits and wait for someone to leave a 2015 server running.
CISA added five vulnerabilities to the KEV catalog on October 8, 2026, and every one of them was public at least three years earlier. Here they are, oldest first:
| CVE | Product | What it does | Severity |
|---|---|---|---|
| CVE-2015-3306 | ProFTPD 1.3.5 (mod_copy) |
Unauthenticated users can copy files anywhere using SITE CPFR / SITE CPTO |
CVSS 10.0 |
| CVE-2015-5477 | ISC BIND | A crafted TKEY query crashes named (DNS goes down) |
CVSS 7.5 |
| CVE-2016-3081 | Apache Struts 2 (S2-032) | Remote code execution via the method: prefix when Dynamic Method Invocation is on |
CVSS 8.1 |
| CVE-2021-3199 | ONLYOFFICE Document Server < 5.6.3 | Path traversal in image upload, leading to remote code execution | CVSS 9.8 |
| CVE-2023-22894 | Strapi 3.2.1 – 4.7.x | Filter queries leak private fields like password hashes and reset tokens | CVSS 4.9 (NVD) / 7.2 (CISA) |
The ProFTPD bug was fixed in May 2015. The Struts fix shipped in April 2016. The software patched itself years ago, but a lot of the servers running it never got the update.
According to joint advisory AA26-281A, published on October 8, 2026, Chinese government-linked cyber actors successfully exploited these flaws to steal sensitive data. The advisory comes from the FBI, CISA and NSA, plus agencies in the UK, Australia, Canada, Japan, New Zealand and Spain. It says the activity is "consistent with the cyber activity publicly known as Flax Typhoon, Ethereal Panda, and Red Juliett."
The advisory names Integrity Technology Group, a China-based for-profit company, as an enabler. The advisory says Integrity Tech "employs individuals who support malicious cyber activity". That support includes building tools, hosting infrastructure and compromising networks.
The most revealing detail is the tool. The agencies describe MicroScan, a Python web application in use since at least 2017 that "contains over 1,300 penetration testing scripts written to scan websites for specific vulnerabilities." Its targets include Apache Struts, Oracle WebLogic, Jenkins, WordPress and Juniper ScreenOS.
Think of it as a locksmith's van with 1,300 keys on the wall, driving down every street on the internet and trying each door. It doesn't matter whether a key was cut in 2015. If it still fits a lock, it gets used.
The advisory's appendix lists eight CVEs recovered as "successfully exploited." They are the five above plus three you've probably heard of:
Old CVEs keep getting exploited because the servers they affect are the ones nobody looks at anymore. Nobody gets an alert about a patch released in 2016. Plenty of prioritisation tools rank by what's trending, and a 2015 bug isn't trending. Most of these servers fall into one of four groups:
mod_copy because that was the default build.For an MSP the problem is bigger, because one technician's old build template can sit on dozens of client networks.
A KEV entry tells you someone was exploited. It doesn't tell you when, so the safe reading is "assume it's still happening."
You are affected if you run any of these five products on an affected version and an attacker can reach it, from the internet or from a foothold inside your network. Check these five things:
proftpd -V or check the banner. If it says 1.3.5 and lists mod_copy,
treat it as exposed. Connect and send SITE CPFR /etc/passwd without logging in. If you
get a 350 reply, the hole is open.struts2-core versions 2.3.20 to 2.3.28 inside WAR files.
Ignore the fixed builds, 2.3.20.3 and 2.3.24.3. Then check whether
struts.enable.DynamicMethodInvocation is set to true.named -v. Anything older than 9.9.7-P2 / 9.10.2-P3 is affected.
Distro packages may carry backported fixes, so check the changelog for the CVE ID.The hard part is the instances you don't know about. Your asset inventory won't list the pilot project from 2021, but MicroScan will still find it.
Patch to a fixed version, disable the vulnerable feature, or take the server off the network. Here's what that means for each product:
mod_copy. Better still, ask whether you need
plain FTP at all.struts.enable.DynamicMethodInvocation to false. A Struts 2.3 app in 2026 is overdue for a
bigger migration anyway.password or resetPasswordToken, and for PUT requests to
/users-permissions/email-templates. Treat a hit as an incident, not a patch ticket.AA26-281A also recommends these general measures:
If any of these servers was exposed, patching isn't the last step. Four of the five KEV entries carry CISA's forensic-triage flag. Check for webshells, new accounts and unusual outbound traffic before you call it closed.
KinoSec runs autonomous penetration tests against external networks, web apps and Active Directory. That's the same attack surface the AA26-281A actors scanned, and the work runs in the same order: find every exposed service, fingerprint it, test it against known weaknesses, then try to chain a foothold into something worse. On your clients' perimeters, a KinoSec pentest would flag:
A patch scanner can tell you a version looks old. A pentest shows what an attacker can actually do with it. To be clear about scope, KinoSec doesn't replace patch management or incident response. If one of these servers was already exposed, forensics still has to answer whether someone got in. What KinoSec does is find the servers before the next scanner does, and write the results into a plain-language report you deliver to your client under your own brand. You can run it across every client on a schedule, so a decade-old bug doesn't have to wait for the annual test.
CISA added five: Apache Struts CVE-2016-3081, ProFTPD CVE-2015-3306, ISC BIND CVE-2015-5477, ONLYOFFICE Docs CVE-2021-3199 and Strapi CVE-2023-22894. All five were public at least three years earlier, and the two oldest date to 2015. They were added the same day the FBI, CISA, NSA and international partners published joint advisory AA26-281A, which reported that Chinese government-linked actors had exploited them.
AA26-281A is a joint cybersecurity advisory published on October 8, 2026 by the FBI, CISA, NSA and agencies in the UK, Australia, Canada, Japan, New Zealand and Spain. It describes Chinese government-linked actors who were enabled by Integrity Technology Group and whose activity is consistent with Flax Typhoon. It also details MicroScan, a tool with more than 1,300 scanning scripts, and lists eight CVEs the actors successfully exploited.
Yes. Apache Struts CVE-2016-3081 (S2-032) allows remote code execution on Struts 2.3.20 through 2.3.28 when Dynamic Method Invocation is enabled, and CISA added it to KEV in October 2026 based on in-the-wild exploitation. Fix it by upgrading to 2.3.20.3, 2.3.24.3 or 2.3.28.1, or by disabling Dynamic Method Invocation.
ProFTPD 1.3.5 with the mod_copy module loaded is vulnerable to CVE-2015-3306. It lets
unauthenticated users copy arbitrary files with the SITE CPFR and SITE CPTO commands. Run
proftpd -V to check the version and modules. A 350 reply to SITE CPFR before login also
confirms exposure. Upgrade to 1.3.5a or later, or unload mod_copy.
Hackers exploit old vulnerabilities because unpatched legacy servers are still online and easy to find with automated scanners. Tools like the MicroScan application described in AA26-281A check thousands of hosts against more than 1,300 known exploit scripts. A server patched last month is safe from these scripts, but one left alone since 2015 is easy prey.