CISA orders federal agencies to patch five exploited flaws in ProFTPD, Struts, BIND, and more

CISA added five actively exploited flaws to its Known Exploited Vulnerabilities catalog and gave federal agencies until October 11 to patch or stop using the affected software. The flaws are older issues in widely deployed open-source server software: ProFTPD arbitrary file access rated 10.0, ONLYOFFICE Docs path traversal enabling remote code execution, Strapi cleartext storage of sensitive data, Apache Struts command injection, and ISC BIND denial of service via TKEY queries. CISA linked the additions to abuse by the China-linked actor Flax Typhoon and a joint advisory from seven countries describing attacks that targeted eight vulnerabilities, including these five.

Check

Identify any use of ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, or ISC BIND, and patch to current releases or retire the affected software immediately.

Affected

Exposed ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND instances on these older versions are being actively exploited, enabling file access, code execution, and denial of service.

Fix

Patch or decommission the five affected products, prioritize internet-facing instances, and review logs for exploitation given confirmed abuse by a state-linked actor.