CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon

• •CISA mandates federal agencies to patch five critical vulnerabilities by October 11, 2026.
• •Flaws exploited by Flax Typhoon include CVE-2015-3306 (CVSS 10.0) and CVE-2021-3199 (CVSS 9.8).
• •Integrity Technology Group is linked to the exploitation of these vulnerabilities.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include CVE-2015-3306 (CVSS 10.0), CVE-2021-3199 (CVSS 9.8), CVE-2023-22894 (CVSS 7.2), CVE-2016-3081 (CVSS 8.1), and CVE-2015-5477 (CVSS 7.5). These flaws affect widely used software, including ProFTPD, ONLYOFFICE Docs, and Apache Struts, allowing attackers to execute arbitrary code, read sensitive files, and cause denial-of-service attacks. The vulnerabilities have been actively exploited to breach networks and steal sensitive data. CISA's directive requires agencies to either apply vendor patches or discontinue the use of the affected software. A joint advisory from several countries, including the U.S. and the U.K., implicated Integrity Technology Group, a Beijing-based cybersecurity firm, in facilitating these attacks.