CISA KEV adds five old bugs at once: Struts S2-032, Strapi private-field leak, ONLYOFFICE path traversal, ProFTPD mod_copy and BIND TKEY

What happened

On 8 October 2026, CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalog, with a federal due date of 11 October. The newest is from 2023 and the oldest from 2015. CISA requires evidence of active exploitation for a KEV listing, but gave no detail on who is exploiting these or how. For four of the five it also requires federal agencies to run forensic triage (CISA KEV). All five have had fixes for years.

Apache Struts, CVE-2016-3081 (S2-032). When Dynamic Method Invocation (DMI) is enabled, an attacker can run code through a method: prefix. It affects Struts 2.3.20 to 2.3.28, except 2.3.20.3 and 2.3.24.3. Fixed in 2.3.20.3, 2.3.24.3 and 2.3.28.1 (Apache S2-032; CVE record).

Strapi, CVE-2023-22894. Attackers can filter on private fields through GET parameters and leak email addresses, password hashes and password reset tokens. It affects v3.2.1 to before v4.8.0, fixed on 15 March 2023. The researcher found an unauthenticated variant (Strapi). Chained with CVE-2023-22621, a template injection in the users-permissions email templates, it gives unauthenticated code execution on Strapi 4.5.5 and earlier: leak a super admin’s reset token, take over the account, then plant code in an email template. CISA notes the chain and that affected versions may be end of life (CISA KEV).

ONLYOFFICE Docs, CVE-2021-3199. Directory traversal leading to code execution through /upload in Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter (CVE record). The 5.6.3 changelog lists “Fix Path Traversal vulnerability via image upload params” (ONLYOFFICE changelog).

ProFTPD, CVE-2015-3306. The mod_copy module in ProFTPD 1.3.5 lets unauthenticated users read and write arbitrary files with the SITE CPFR and SITE CPTO commands (CVE record). Debian noted this could also lead to code execution, and fixed it in DSA-3263-1 in May 2015 (Debian).

ISC BIND, CVE-2015-5477. A crafted TKEY query makes named hit an assertion and exit, in BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 (CVE record). It takes down the DNS server; it does not give access.

Am I affected?

These versions are old, so the question is where they still hide: base images, vendored dependencies, appliances and “temporary” servers. Search software inventories, SBOMs and container registries for the package names, not only running hosts.

Struts. Find the Struts core JAR and check whether DMI is on:

find / -name 'struts2-core-*.jar' 2>/dev/null
grep -rn 'struts.enable.DynamicMethodInvocation' --include='struts*.xml' --include='*.properties' /path/to/webapps

Any struts2-core from 2.3.20 to 2.3.28, other than 2.3.20.3 and 2.3.24.3, is vulnerable when that setting is true.

Strapi. Check the version in each project, and search web logs for the leak pattern Strapi published: GET parameters that put email, password, reset_password_token or resetPasswordToken in brackets, raw or URL-encoded (Strapi).

npm ls @strapi/strapi strapi
grep -E 'GET [^ ]*(\[|%5B)(email|password|reset_password_token|resetPasswordToken)(\]|%5D)' access.log*
grep -E 'PUT [^ ]*/users-permissions/email-templates' access.log*

Strapi says several matching requests point to leaked credentials and tokens. A PUT to /users-permissions/email-templates is the sign of the code-execution step. Review email templates for code inside lodash template delimiters you do not recognise.

ONLYOFFICE Document Server. Anything before 5.6.3 is affected when JWT is used. Check the image tag of onlyoffice/documentserver containers and the version of installed onlyoffice-documentserver packages.

ProFTPD. Check the version and whether mod_copy is compiled in or loaded, then search FTP logs for the two commands:

proftpd -v
proftpd -l | grep -i mod_copy
grep -rniE 'SITE (CPFR|CPTO)' /var/log/proftpd/ 2>/dev/null

BIND.

named -v

BIND 9.x before 9.9.7-P2, and 9.10.x before 9.10.2-P3, is affected. Distribution packages carry backports, so check your vendor’s advisory for CVE-2015-5477. Red Hat fixed it on 28 July 2015 in RHSA-2015:1513, in bind-9.9.4-18.el7_1.3 for RHEL 7 and bind-9.8.2-0.37.rc1.el6_7.2 for RHEL 6 (Red Hat).

What to do now

1. Struts: upgrade to a supported Struts release. The 2016 fixed versions are themselves long obsolete. If you cannot, disable Dynamic Method Invocation, which is Apache’s workaround (Apache S2-032).
2. Strapi: upgrade to 4.8.0 or later; Strapi recommended going beyond 4.8.0 at the time (Strapi). If the log searches above match, reset every admin and API user password, invalidate reset tokens and API tokens, and inspect email templates.
3. ONLYOFFICE: upgrade Document Server to a current release. Do not expose an old Document Server to the internet while you plan the upgrade.
4. ProFTPD: take your distribution’s fixed package or a current ProFTPD release. If you do not need mod_copy, stop loading it. If logs show SITE CPFR or SITE CPTO from unknown clients, check the web root and any directory the FTP user could write for dropped files.
5. BIND: upgrade named to a supported BIND 9 release. A crash from this bug shows as named exiting on an assertion failure, so check for unexplained named restarts.
6. End-of-life installs: CISA’s instruction is to apply the vendor fix or stop using the product (CISA KEV). For these five, “the vendor fix” means a modern release, not the 2015 to 2023 patch.

Sources

• CISA Known Exploited Vulnerabilities catalog
• Apache Struts security bulletin S2-032
• Strapi: security disclosure of vulnerabilities (CVE-2023-22894, CVE-2023-22621)
• ONLYOFFICE Document Server changelog, 5.6.3
• Debian DSA-3263-1: proftpd-dfsg
• Red Hat RHSA-2015:1513: bind
• CVE-2016-3081 record
• CVE-2023-22894 record
• CVE-2021-3199 record
• CVE-2015-3306 record
• CVE-2015-5477 record