+91 80401 38000sales@servergurus.com24/7 Expert Support
support@servergurus.comClient Portal →
ServerGurus
← All posts
SecurityCVEHostingInfrastructure

CISA Put ProFTPD and BIND on a Sunday Deadline - Hunt Before 11 Oct

By ServerGurus Team10 October 20267 min read
CISA Put ProFTPD and BIND on a Sunday Deadline - Hunt Before 11 Oct

The Situation

CISA's Known Exploited Vulnerabilities catalog jumped on 8 October 2026. Catalog version 2026.10.08, dateReleased 2026-10-08T20:09:18.9833Z, 1739 entries. Five new rows, all dateAdded 2026-10-08, all dueDate 2026-10-11. That is Sunday. Ransomware-campaign flag on every row: Unknown.[1]

These are not 2026 zero-days. The newest CVE in this batch is from 2023. Two are from 2015. A KEV listing is CISA saying exploitation was observed, not that the patch shipped this week.[1]

Same calendar day, CISA published AA26-281A (release 8 October 2026): China-linked actors enabled by Integrity Technology Group, TTPs consistent with activity tracked as Flax Typhoon / Ethereal Panda / Red Juliett. The advisory's affected-product list includes these five CVEs plus three that were already on KEV (CVE-2014-6278 GNU Bash, CVE-2019-11510 Pulse Connect Secure, CVE-2021-22205 GitLab). We are not restating the already-catalogued three here.[2]

BOD 26-04 superseded BOD 22-01.[3] The three-day band is the federal clock, and the directive's own language pairs that timeline with forensic triage of the asset - not only a package bump.[3]

CVE Product What CISA wrote NVD floor (vendor-fixed)
CVE-2015-3306 ProFTPD unauth read/write via SITE CPFR / SITE CPTO mod_copy in 1.3.5
CVE-2015-5477 ISC BIND unauth DoS via TKEY queries 9.9.7-P2 / 9.10.2-P3
CVE-2016-3081 Apache Struts RCE via method: prefix when DMI is on 2.3.20.3 / 2.3.24.3 / 2.3.28.1
CVE-2021-3199 ONLYOFFICE Docs path traversal in image upload, can be RCE when JWT is used Document Server 5.6.3
CVE-2023-22894 Strapi admin-panel query filter leaks sensitive user fields; CISA: chain with CVE-2023-22621 for RCE vendor: ≥4.5.6 (they also urge ≥4.8.0)

What each bug actually is

ProFTPD CVE-2015-3306. NVD, verbatim: the mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write arbitrary files via site cpfr and site cpto. CVSS v3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). CISA's short description matches that command pair.[1][4]

This is not "FTP is old." It is unauthenticated file copy into whatever the daemon can write - including a vhost docroot if the service user can reach it.[4] We are not publishing a copy sequence. NVD's reference list already names public PoC URLs and a Rapid7 module page; that is a scanner-existence fact, not a lab result from us.[4]

BIND CVE-2015-5477. ISC AA-01272 (28 July 2015): a constructed TKEY query triggers a REQUIRE assertion and named exits. Recursive and authoritative are in range. ACLs and "deny service" options do not help - the crash is early in packet handling. ISC listed no workaround. Patched builds they named: 9.9.7-P2 and 9.10.2-P3. Affected window in that advisory: 9.1.0 through 9.9.7-P1 and 9.10.0 through 9.10.2-P2. NVD CVSS v3.1 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). This is DoS, not RCE.[5][9]

Struts CVE-2016-3081. Apache S2-032: RCE via method: prefix when Dynamic Method Invocation is enabled. Patches they named: 2.3.20.3, 2.3.24.3, 2.3.28.1. Rating on that bulletin: Important. NVD also requires DMI enabled.[6][10]

ONLYOFFICE CVE-2021-3199. NVD: directory traversal with RCE in /upload on Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image-upload parameter. CVSS v3.1 9.8. The 5.6.3 changelog line is "Fix Path Traversal vulnerability via image upload params (Bug #46113)." That is the vendor's wording, not a root-cause writeup.[7][11]

Strapi CVE-2023-22894. NVD: through 4.5.5, attackers with admin-panel access can filter on private columns and infer sensitive user details (including password hashes / reset tokens if they are a super admin). CVSS v3.1 4.9 MEDIUM. CISA's KEV row adds two things NVD's one-liner does not: the product may be EoL, and the bug can be chained with CVE-2023-22621 (SSTI → RCE in the default users-permissions email templates; Strapi's own patch floor for 22621 is ≥4.5.6, and they urge ≥4.8.0). Do not file 22894 as "unauth RCE" by itself. The chain is CISA's statement.[1][8][12]

Hunt the fleet - prove absence

Do not assume a cPanel box runs ProFTPD. Plenty of WHM servers ship Pure-FTPd. Do not assume BIND either - PowerDNS and unbound are common. The ticket is "is this binary on this host," not "shared hosting therefore ProFTPD."

# packages (EL / Debian)
rpm -q proftpd bind bind9 2>/dev/null
dpkg -l 'proftpd*' 'bind9' 2>/dev/null | awk '/^ii/{print}'

# listening services
ss -lntp | grep -E ':21 |:53 |:8080 |:8443 |:1337 '

# Struts jars left in exploded Java apps / old WARs
find /home /var/www /opt /usr/share/tomcat* -name 'struts2-core*.jar' 2>/dev/null

# ONLYOFFICE (host package or container)
rpm -q onlyoffice-documentserver 2>/dev/null
dpkg -l onlyoffice-documentserver 2>/dev/null | awk '/^ii/{print}'
docker ps --format '{{.Image}} {{.Names}}' | grep -i onlyoffice || true

# Strapi (Node trees, not a distro package)
find /home /var/www /opt -name 'package.json' -exec grep -l '"strapi"' {} \; 2>/dev/null

Anything that still prints ProFTPD 1.3.5, BIND below the ISC patched releases (or an appliance that never moved off 9.9.7-P1 / 9.10.2-P2), a struts2-core jar in the S2-032 ranges with DMI on, Document Server < 5.6.3, or Strapi ≤4.5.5 is in this KEV batch.[1][4][9]

Supported BIND 9.18/9.20 in 2026 is not the 2015 branch - still check the appliance image, not the hypervisor's named.[9]

Patch / mitigate from the vendor pages, not from a blog:

  • BIND: upgrade. ISC said there is no workaround.[9]
  • ProFTPD: get off 1.3.5 mod_copy.[4] If the box does not even install ProFTPD, close the ticket with the package query, not a guessed config edit.
  • Struts: disable DMI if you can, or land 2.3.20.3 / 2.3.24.3 / 2.3.28.1 (or a currently supported Struts line - S2-032 is a 2.3.x bulletin).[10]
  • ONLYOFFICE: Document Server 5.6.3 or later. Current Docs is years past 5.6.3; leftover Docker tags are the exposure.[11]
  • Strapi: CISA's own notes say discontinue / move to a supported version. Vendor disclosure: ≥4.5.6, strongly ≥4.8.0. v3 was already EoL on 31 Dec 2022.[1][12]

Federal civilian agencies: the published due date is 11 October 2026. Everyone else: BOD 26-04 binds FCEB. The operational fact is the KEV row - exploitation observed - plus AA26-281A naming the same five CVEs in an active actor set.[1][2][3]

Honesty / What We Could Not Verify

  • We did not scan the internet or our own customers for these five. This post is catalog + vendor pages.
  • KEV ≠ 2026 exploit volume. CISA did not publish a hit count, a mass-scan census, or a ransomware flag (Unknown on all five).[1]
  • AA26-281A lists eight CVEs. We are not claiming the 8 Oct KEV add is "because of" that advisory. Same-day, overlapping CVE IDs. Attribution language is CISA's ("links to the Chinese government", "TTPs consistent with"). We are not adding extra actor names.[2]
  • BIND is availability, not host takeover. Do not file it next to ProFTPD file-write or Struts RCE.[5][9]
  • ProFTPD → webshell is a known historical path (NVD references include public exploit writeups). We did not reproduce it. Do not treat "CVSS 10" as proof that your proftpd user can write the PHP docroot until you check the uid and the vhost path.[4]
  • ONLYOFFICE NVD condition is "when JWT is used." A JWT-disabled leftover 5.6.2 is a different ticket than the NVD sentence. We did not test that split.[7]
  • Strapi 22894 alone is PR:H information leak (4.9). The RCE story is the 22621 chain, which CISA stated and Strapi documented separately. NVD's affected-config text for 22894 is "through 4.5.5"; do not silently widen it to "all v4."[1][8][12]
  • Debian DSA-3263 is in CISA's notes for ProFTPD.[1] The debian-security-announce HTML we hit was a JS challenge; we did not copy a Debian package version we could not read.
  • This lab did not start named, ProFTPD, Struts, Document Server, or Strapi for this post.

What this is not

  • Not a cPanel CVE. Yesterday's WP Toolkit handler (CVE-2026-93699, floor 6.11.4) is a different ticket. A box can be on 6.11.4 and still be running 2015 proftpd.
  • Not OpenSSH, not a kernel KEV, not wp2shell.
  • Not "patch BIND on every cPanel server." Inventory first.
  • Not a license to skip the three already-on-KEV AA26 CVEs (Shellshock, Pulse, GitLab) - they were already catalogued; this post is the 8 Oct five.[2]

Sources

[1] https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json [2] https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a [3] https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk [4] https://nvd.nist.gov/vuln/detail/CVE-2015-3306 [5] https://nvd.nist.gov/vuln/detail/CVE-2015-5477 [6] https://nvd.nist.gov/vuln/detail/CVE-2016-3081 [7] https://nvd.nist.gov/vuln/detail/CVE-2021-3199 [8] https://nvd.nist.gov/vuln/detail/CVE-2023-22894 [9] https://web.archive.org/web/20150729014733/https://kb.isc.org/article/AA-01272 [10] https://cwiki.apache.org/confluence/display/WW/S2-032 [11] https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md [12] https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve

Ready to build your infrastructure?

Get a quote from our Hyderabad-based team - Tier IV datacenter, real support, INR or USD billing.

View pricingRequest a quoteWhatsApp sales