CISA Expands Exploited Vulnerabilities List to Include Five More Software Flaws

The U.S. Cybersecurity and Infrastructure Security Agency announced Wednesday that it has added five new software vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog.

The catalog now includes flaws in the open‑source FTP server ProFTPD, the collaborative editing suite ONLYOFFICE Docs, the headless CMS Strapi, the Apache Struts framework, and the ISC BIND DNS server. Each of these products is widely deployed in enterprise and internet‑facing environments.

According to CISA, the vulnerabilities have been observed in active exploitation campaigns. The ProFTPD issue can allow unauthenticated attackers to execute arbitrary code on affected servers. ONLYOFFICE Docs has a weakness that could let threat actors bypass document‑processing controls. Strapi’s flaw may enable privilege escalation for malicious users of the content‑management API. Apache Struts, already known for high‑profile breaches, contains a newly identified path to remote code execution. The ISC BIND vulnerability could be leveraged to poison DNS responses or disrupt name resolution services.

Adding these weaknesses to the KEV list signals that federal agencies and critical‑infrastructure operators should prioritize remediation. The catalog is used by government procurement and risk‑management programs to enforce baseline security requirements, and many private‑sector organizations adopt it as a benchmark for patching schedules.

The move follows a pattern of regular updates by CISA, which began publishing the KEV catalog in early 2023 to provide a curated set of vulnerabilities that have proven exploitability. Past entries have included high‑impact flaws in Microsoft Exchange, Log4j, and other widely used platforms, prompting coordinated patching efforts across the ecosystem.

Security teams are advised to verify whether any of their assets run the listed software, apply vendor‑supplied patches or mitigations promptly, and monitor for indicators of compromise associated with the disclosed exploits. CISA’s ongoing updates aim to reduce the window of exposure for known threats and to encourage a proactive security posture among both public and private entities.