The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on October 8, 2026, confirming that they are being actively exploited in real-world attacks.
The newly listed flaws affect Apache Struts, BIND, ProFTPD, Strapi, and ONLYOFFICE Docs. All five vulnerabilities received CVE identifiers between 2015 and 2023. CISA directed U.S. federal agencies to complete remediation by October 11, 2026, and urged organizations to investigate potential compromises.
Particular attention was given to the headless CMS Strapi vulnerability CVE-2023-22894. The issue arises because sensitive information is stored in plaintext. An attacker who gains access to the administrative interface can use query filters to retrieve highly sensitive user data.
When CVE-2023-22894 is chained with CVE-2023-22621, the combination allows remote code execution. CISA noted that some affected product versions may have reached end-of-life status, increasing the risk for organizations still running unsupported deployments.
The agency continues to maintain the KEV catalog as a prioritized list of vulnerabilities that threat actors are actively exploiting, helping defenders focus remediation efforts on the most urgent threats.
