Five old services enter the exploited catalog
The catalog feed, reread on 17 October 2026, is version 2026.10.16, with 1,748 entries. The five additions of 8 October remain the subject of this note: BIND, Struts, Strapi, ONLYOFFICE Docs, and ProFTPD. Their due date remains 11 October. The two additions of 16 October, BeyondTrust and Fortinet, have their own note.
Getting started
Generated image · SecuFocus
At a glance
Key points
The catalog says exploited. It does not put a file in our hands. 11 October is the date written in the feed, not a deadline we set.
What changes
The JSON feed of the known exploited vulnerabilities catalog, read on 9 October 2026, is version 2026.10.08, with 1,739 entries, and a release time of 8 October 2026 at 20:09 UTC. Five entries were added on 8 October. Their due date is 11 October. None is marked as known in a ransomware campaign: the field says Unknown.
On 14 October 2026 the same feed was version 2026.10.13, with 1,741 entries and a release time of 13 October 2026 at 19:10 UTC. Two entries were added on 13 October: CVE-2026-104935, Ivanti Connect Secure, and CVE-2026-96951, Windows. Neither is one of the five additions from 8 October. Each has its own note. An earlier reading the same day, at 14:34 UTC, saw only one of them, and 1,740 entries. On 15 October 2026 the feed is version 2026.10.14, with 1,745 entries, released on 14 October 2026 at 19:27 UTC. Four entries were added on 14 October. They have their own note. The five from 8 October are not among them.
The required action points the named stakeholders to directive BOD 26-04, and to triage guidance. We did not reread that directive this morning. 11 October is the date written in the catalog. It is not a deadline SecuFocus sets for other readers.
On 16 October 2026, the feed is version 2026.10.15, with 1,746 entries, released on 15 October 2026 at 17:00 UTC. One entry was added on 15 October: CVE-2026-21589, Atlassian. It has its own note. The five additions of 8 October are not part of it. On 17 October 2026, the feed is version 2026.10.16, with 1,748 entries, released on 16 October 2026 at 17:15 UTC. Two entries were added on 16 October: CVE-2026-102764, BeyondTrust, and CVE-2025-61624, Fortinet. They have their own note. The five additions of 8 October are not part of it. Their due date remains 11 October.
The five, without flattening them
BIND, CVE-2015-5477. CISA describes a data processing error that could let remote attackers take the service down with TKEY queries. The English NVD record, modified on 9 October 2026, status Modified, names BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3.
Struts, CVE-2016-3081. CISA describes command injection through the method: prefix when Dynamic Method Invocation is enabled. The NVD record, modified the same day, status Modified, names 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, under the same condition. The CPE list is wider. We do not flatten it.
Strapi, CVE-2023-22894. CISA describes cleartext storage: an attacker who already has the admin panel can recover user details through a query filter. It says the flaw can be chained with CVE-2023-22621 to run code remotely, and that the affected products could be end of life. The NVD record, status Undergoing Analysis, says through 4.5.5 in the English description. The CPE range runs from 3.2.1 inclusive to before 4.8.0. We do not pick a safe version between those two readings.
ONLYOFFICE Docs, CVE-2021-3199. CISA describes a path traversal that could lead to remote code execution when JWT is used, through a /.. sequence in an image upload parameter. The NVD record, status Modified, says Document Server before 5.6.3, under the same condition.
ProFTPD, CVE-2015-3306. CISA describes improper access control that could let remote attackers read and write arbitrary files through the site cpfr and site cpto commands. The NVD record, status Undergoing Analysis, names ProFTPD 1.3.5 and the mod_copy module.
What we did not check
We did not install these five programs, and we did not download a fix. A bound in an NVD record is not a file we held on 9 October 2026. Exploited comes from the catalog addition, not from a SecuFocus test. We did not open vendor pages outside the allowed list. An HTML alert address for 8 October returned 403. The JSON feed answered.
The choice
If you expose BIND, a Struts install with Dynamic Method Invocation, a Strapi admin panel that can be reached, ONLYOFFICE Docs with JWT, or ProFTPD 1.3.5, the catalog calls them exploited. Take them off the network, or follow the vendor fix, then reread the records before you call a version safe. For Strapi, the two readings do not give the same bound. If you run none of these five, this note changes nothing.
Check and explore
Sources for this article
Numbers connect each reference to the passages that use it. Dates show when the documentation was consulted.
- NVD, CVE-2016-3081, record modified 9 October 2026 ↗nvd.nist.gov ·
- NVD, CVE-2021-3199, record modified 9 October 2026 ↗nvd.nist.gov ·
- NVD, CVE-2015-3306, record modified 9 October 2026 ↗nvd.nist.gov ·
This article draws on the sources above. The exercises are for you to try on your devices; SecuFocus does not present them as tests carried out by its editorial team. Interfaces and features can change. Method and corrections.
Cite this article
Keep this reference with the article when you save or share it.