CISA KEV catalog update flags five flaws for immediate MSP remediation

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has updated its Known Exploited Vulnerabilities (KEV) catalog to include five distinct software flaws. According to Security Affairs, the additions cover ProFTPD, Strapi, Apache Struts, ISC BIND, and ONLYOFFICE Docs. This inclusion indicates that threat actors are actively targeting these specific weaknesses. Managed service providers should treat this update as a directive to audit their client infrastructure for these components and apply patches where available.

How it unfolded

• CISA identified active exploitation of vulnerabilities in ProFTPD, an FTP server software, and added it to the KEV catalog.
• The agency simultaneously flagged a flaw in Strapi, a popular headless CMS, due to ongoing real-world attacks.
• Apache Struts, a web application framework, was added to the list following confirmed exploitation attempts.
• ISC BIND, a widely used DNS software, saw its vulnerability added to the catalog by CISA.
• ONLYOFFICE Docs, a collaborative suite, was also included in this batch of five new entries.

Who is affected

Organizations using ProFTPD for file transfer services face immediate risk. According to the report by Security Affairs, CISA added this FTP server vulnerability to its KEV catalog because it is being exploited. Managed service providers managing legacy infrastructure or specific FTP servers must verify versions and apply updates. The widespread use of FTP in industrial and internal networks makes this a high-priority item for many MSPs.

Web development teams relying on Strapi or Apache Struts are also at risk. Strapi is a Node.js headless CMS, while Apache Struts is a Java web framework. Both have been added to the KEV catalog by CISA. Organizations hosting public-facing web applications built on these technologies are likely targets. MSPs supporting development environments or content management systems need to scan for these specific frameworks and ensure they are not running vulnerable versions.

DNS infrastructure and collaboration tools present further exposure points. ISC BIND is a cornerstone of the internet's DNS infrastructure. CISA added a BIND flaw to the KEV catalog, signaling that attackers are probing DNS servers. Additionally, ONLYOFFICE Docs was included in the update. Organizations using this collaborative document editing suite should check their deployments. MSPs must ensure these critical infrastructure components are secured to prevent lateral movement or data exfiltration.

Our take on the response

The addition of these five specific products to the KEV catalog underscores the breadth of current threats. CISA is not just tracking high-profile operating system flaws but also specialized software like CMS platforms and DNS servers. For managed service providers, this means vulnerability management cannot be limited to standard server patches. The inclusion of Strapi and ONLYOFFICE Docs highlights the risk in application-layer software. MSPs must expand their monitoring to include web applications and collaboration tools.

The simultaneous addition of these five flaws suggests a coordinated effort to highlight widespread exploitation. Security Affairs reports that these vulnerabilities are linked to active cyber campaigns. This is a clear signal from CISA that these vectors are in active use by adversaries. MSPs should prioritize remediation based on the KEV status rather than just CVSS scores. The urgency here is driven by confirmed exploitation, not just theoretical risk.

What to do and how to stay safe: CISA

• Scan client networks for instances of ProFTPD, Strapi, Apache Struts, ISC BIND, and ONLYOFFICE Docs to identify exposure.
• Verify current software versions against vendor advisories to determine if they contain the known exploited vulnerabilities.
• Apply security patches or updates provided by the respective vendors to mitigate the risks immediately.
• Monitor network logs for unusual traffic patterns associated with FTP, DNS, or web application attacks.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which software vulnerabilities did CISA add to the KEV catalog in this update?

CISA added vulnerabilities in ProFTPD, Strapi, Apache Struts, ISC BIND, and ONLYOFFICE Docs to the catalog.

Why are these specific vulnerabilities included in the KEV catalog?

They are included because they are being actively exploited by threat actors in the wild.

Does the source material confirm that patches are available for all five flaws?

The source material does not confirm the availability of patches for all five flaws.