CISA Added Five Exploited Vulnerabilities to Catalog
Federal agencies have until October 11, 2026, to patch systems exploited by the Flax Typhoon threat actor.
Updated on Oct. 9, 2026 in Cybersecurity
Live Poll
Do you trust the federal government to keep critical digital infrastructure secure from foreign cyberattacks?
The Cybersecurity and Infrastructure Security Agency (CISA) added five new security vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on October 8, 2026. These flaws have been actively leveraged by a threat actor known as Flax Typhoon to gain initial access to organizations.
Why it matters
These vulnerabilities allow attackers to siphon sensitive data and maintain persistence within secure networks. The update forces a rapid remediation timeline for federal agencies to prevent continued exploitation by actors linked to the Integrity Technology Group.
The newly cataloged vulnerabilities include CVE-2015-3306 with a critical CVSS score of 10.0, CVE-2021-3199 at 9.8, CVE-2016-3081 at 8.1, CVE-2015-5477 at 7.5, and CVE-2023-22894 at 7.2. These figures compare to a maximum severity scale of 10.0.
The players
CISA
The Cybersecurity and Infrastructure Security Agency is the lead federal body responsible for maintaining the KEV catalog and securing U.S. civilian government networks.
Flax Typhoon
A sophisticated threat actor known for using specialized scripts and network exploits to exfiltrate data from targeted organizations.
Integrity Technology Group
A China-based cybersecurity firm linked to the operations of the Flax Typhoon threat actor.
The details
The threat actor Flax Typhoon uses these vulnerabilities to execute scanning tools, cross-site scripting (XSS) — a technique where attackers inject malicious scripts into trusted websites — and password spraying against Microsoft Exchange servers. The attackers establish long-term persistence through compromised VPN software. Once inside, they deploy specialized scripts to exfiltrate emails and internal credentials from the target environment.
Timeline
November 2021: CVE-2019-11510 and CVE-2021-22205 added to KEV catalog.
October 2025: CVE-2014-6278 added to KEV catalog.
October 8, 2026: CISA added five vulnerabilities to KEV catalog.
October 11, 2026: Deadline for federal agencies to patch or stop use.
The Tech Race
This action aligns with the standardized remediation cycle established by CISA's Binding Operational Directive 22-01. It marks a continuation of the agency's effort to address the total of eight vulnerabilities associated with Flax Typhoon's recent operational surge.
Private sector organizations should review their systems against the newly identified CVEs to ensure they are not using compromised software versions. System administrators must prioritize patching these flaws, particularly those identified with high CVSS scores, to mitigate the risk of password spraying and data exfiltration.
The takeaway
The addition of these five vulnerabilities demonstrates that attackers continue to find success by chaining older, unpatched flaws with newer exploits. Organizations should treat the October 11, 2026, federal deadline as a baseline for their own internal remediation timelines.
What happens next
Federal agencies are required to patch or discontinue the use of the affected software by the October 11, 2026, deadline.
Further reading
For more information on how national agencies monitor active network threats, visit the Cybersecurity section.
Live Poll
Do you trust the federal government to keep critical digital infrastructure secure from foreign cyberattacks?
