Old vulnerabilities from 2015 still exploited: the table of 6 new CISA catalog entries
Between October 4 and 8, 2026, the U.S. cybersecurity agency CISA added six flaws to its catalog of actively exploited vulnerabilities (KEV). Only one is recent (Citrix NetScaler, CVE-2026-88779). The others are 3 to 11 years old, and three date from 2015 and 2016. These old vulnerabilities have had patches for a decade… and attackers still use them today, because they work.
6
flaws added to the KEV catalog in 5 days
3
date from 2015 or 2016
11 years
age of the oldest (ProFTPD)
Oct. 29
deadline set for U.S. federal agencies
CISA only lists a flaw in this catalog when it has evidence of real-world exploitation. In other words, servers left unpatched since 2015 still exist in large enough numbers to be worth attacking.
The table: which flaw, how old, what risk
| Product | Flaw | Year | What an attacker can do | What to do |
|---|---|---|---|---|
| ProFTPD (FTP server) | CVE-2015-3306 | 2015 (11 years) | Write files to the server without a password, then plant a backdoor | Update or disable the mod_copy module; better: replace FTP with SFTP |
| ISC BIND (DNS server) | CVE-2015-5477 | 2015 (11 years) | Crash DNS with a single packet: no more email or internal sites | Update to a supported version |
| Apache Struts 2 (Java web apps) | CVE-2016-3081 | 2016 (10 years) | Run commands remotely on the application | Update and disable DMI, or retire the app |
| ONLYOFFICE Docs (document editing) | CVE-2021-3199 | 2021 (5 years) | Read or write files outside the intended folder | Update to version 6.1 or later |
| Strapi (content management) | CVE-2023-22894 | 2023 (3 years) | Expose sensitive admin panel information | Update, rotate secrets, enable multi-factor authentication |
Why an SMB should care
This software often hides where nobody looks anymore: the FTP server set up “temporarily” for a client in 2016, the old DNS server in the closet, a vendor’s web app that never got updated, or a network device that bundles these components. Nobody owns it, so nobody patches it. That’s exactly what attackers’ bots look for when they scan the internet.
Same logic as for edge devices like the SonicWall SMA1000 vulnerability or FortiBleed: whatever is exposed to the internet must be inventoried and updated first.
This week’s checklist
Inventory of old exposed systems
- ☐ List everything reachable from the internet: firewall, VPN, FTP, DNS, web apps, NAS.
- ☐ For each item, note the version and the date of the last update.
- ☐ Flag end-of-life products (no more patches) and plan their replacement.
- ☐ Shut down what’s no longer used, especially the old “temporary” FTP.
- ☐ Put updates on a monthly calendar, with a named owner.
- ☐ Turn on automated 24/7 monitoring with on-call technician response to catch attempts.
Need help with updates? See our server management service and our cybersecurity services.
Book your free cyber check
Not sure what your SMB exposes on the internet? Our free cyber check finds exposed services and outdated software, and gives you a clear, jargon-free plan.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Sources
- Security Arsenal — CISA KEV Flash: 6 CVEs added (Oct 10, 2026)
- CISA — Known Exploited Vulnerabilities Catalog
Photo: Sora Shimazaki, Pexels (Pexels licence).