Why 2015 CVEs Keep Landing in CISA KEV: The 8 October Batch

On 8 October 2026 CISA added five vulnerabilities to the Known Exploited Vulnerabilities catalog, all with a due date of 11 October. None of them is new. The oldest, ProFTPD CVE-2015-3306, was published on 18 May 2015, more than eleven years before it landed in KEV. The newest, Strapi CVE-2023-22894, dates from April 2023.

A KEV entry means CISA has evidence of exploitation in the wild. It does not say when, by whom, or why now. What it does tell you is that old, boring software is still being found and used by attackers.

What's affected

The ages are computed from the NVD publication date to the KEV date added of 8 October 2026.

What each one does:

• BIND CVE-2015-5477: a crafted TKEY query triggers a REQUIRE assertion failure and the named daemon exits. It is a denial of service, CVSS 7.5 in NVD.
• Struts CVE-2016-3081 (S2-032): remote code execution through the method: prefix when Dynamic Method Invocation is enabled. Apache's bulletin says to disable DMI or upgrade.
• Strapi CVE-2023-22894: an admin panel user can filter on private fields and infer sensitive values. Strapi says it can be chained with CVE-2023-22621 for remote code execution. CISA flags the product as possibly end of life.
• ONLYOFFICE CVE-2021-3199: path traversal in an image upload parameter that can lead to remote code execution. NVD scores it 9.8.
• ProFTPD CVE-2015-3306: the mod_copy module lets remote attackers read and write arbitrary files with the SITE CPFR and SITE CPTO commands. NVD scores it 10.0.

Four of the five carry the "forensic triage" flag in the catalog. Only BIND, the denial of service, does not.

How to check if you're exposed

These are the usual places old software hides: appliances, containers, build images, and the server nobody owns. Run these on hosts, then check images.

# Struts: find jars and DMI setting
find / -name 'struts2-core*.jar' 2>/dev/null
grep -rn "DynamicMethodInvocation" /opt /srv /var/lib 2>/dev/null | grep -i struts

# BIND: version, and distro backport check
named -v
rpm -q --changelog bind 2>/dev/null | grep CVE-2015-5477
apt changelog bind9 2>/dev/null | grep CVE-2015-5477

# ProFTPD: is mod_copy loaded?
proftpd -vv 2>/dev/null | grep -i version
grep -rn "mod_copy" /etc/proftpd* 2>/dev/null

# ONLYOFFICE (package installs)
dpkg -l | grep -i onlyoffice-documentserver

# Strapi
npm ls @strapi/strapi

For logs, hunt for the exploit shapes:

# Struts method: prefix in query strings
grep -E '[?&]method:' /var/log/*/access.log

# ProFTPD site copy commands
grep -iE 'SITE (CPFR|CPTO)' /var/log/proftpd/*

Strapi's own disclosure suggests searching logs for GET parameters containing email, password, reset_password_token or resetPasswordToken in square brackets. It also lists a PUT request to /users-permissions/email-templates as a sign of the chained bug. A hit means start incident response.

Distro packages often patch without changing the upstream version number, so a version string alone can mislead. Check the changelog for the CVE ID before you call a host vulnerable or clean.

What to do now

1. Search every environment, not only production: staging, lab, build images, and anything acquired by merger.
2. Upgrade or patch to the fixed versions in the table. For ProFTPD, take your distribution's update or remove the mod_copy module if you do not use it.
3. For Struts, if you cannot upgrade immediately, disable Dynamic Method Invocation as the Apache bulletin describes.
4. For Strapi, move to a supported release. CISA says users should discontinue use of end of life versions.
5. For the four entries with forensic triage, do not stop at patching. Check logs for the patterns above and look for new files, accounts and outbound connections on those hosts.
6. Add the five CVE IDs to your scanner's watchlist so a rebuilt image does not bring them back.

Why it matters

CISA does not publish a reason for each addition, so what follows is our reading, not a fact from the catalog. Old flaws stay useful because the software they live in never gets touched. An FTP server set up in 2014 keeps running. A Struts application that works is rarely rewritten. Nobody gets an alert for a vulnerability that was patched a decade ago.

There is also a tooling gap. Many programs rank findings by recent severity or by what is trending, and an eleven year old CVE does not trend. Exploitation status is a better signal than age, and KEV is the cleanest public source for it.

The practical lesson is inventory. You cannot patch what you cannot find, and the hosts that matter here are the ones missing from the asset list. Gold lists CVEs with their CISA KEV status, so you can look up any CVE ID from this post, and the free scan at gold.safeguard.sh/scan checks a package.json, requirements.txt or SBOM in your browser without the file leaving your machine.

Try it yourself

Pick one of the five products and run the matching find command from above on a single server or image you own. Write down the version, whether the vulnerable feature is on, and who owns the host. If you cannot answer the last one, that is the finding.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• CISA Known Exploited Vulnerabilities catalog (JSON feed)
• CISA BOD 26-04: Prioritizing Security Updates Based on Risk
• Apache Struts S2-032
• Strapi security disclosure for CVE-2023-22894 and CVE-2023-22621
• Debian DSA-3263-1, ProFTPD CVE-2015-3306
• NVD CVE-2015-5477
• NVD CVE-2016-3081
• NVD CVE-2023-22894
• NVD CVE-2021-3199
• NVD CVE-2015-3306