Legacy Infrastructure Debt: Decade-Old Vulnerabilities Return to Active Exploitation

The October 8 batch carries a pattern that should alarm any CISO conducting a vulnerability aging analysis: three of the five entries added that day are vulnerabilities from 2015 and 2016, now confirmed actively exploited in 2026. Their patch deadline of October 11 has already passed.

CVE-2015-3306 in ProFTPD allows unauthenticated remote attackers to read and write arbitrary files via the SITE CPFR and SITE CPTO commands — essentially a file system traversal primitive with no authentication barrier. CVE-2015-5477 in ISC BIND permits remote denial of service through malformed TKEY queries, a well-documented attack vector that should have been eradicated from production years ago. CVE-2016-3081 in Apache Struts enables remote code execution via Dynamic Method Invocation — a vulnerability class that the Equifax breach of 2017 made infamous. These are not novel discoveries; they are indicators of scan-and-exploit campaigns deliberately targeting organizations that have allowed legacy software to persist without lifecycle management.

If your environment runs any of these products and versions, the immediate question is not just patching — it is why these systems still exist. Conduct asset inventory to identify all ProFTPD, BIND, and Struts deployments. For any instance that cannot be immediately patched, enforce network-layer access controls to restrict exposure, review file integrity monitoring logs for evidence of exfiltration or web shell placement, and evaluate whether decommissioning is operationally feasible.

Developer and Collaboration Platforms: Chained Exploitation and Supply Chain Risk

The remaining three October 8 entries converge on developer tooling and internal collaboration infrastructure — a category that often receives less hardening attention despite handling sensitive data and source material.

CVE-2021-3199 in ONLYOFFICE Docs is a path traversal vulnerability exploitable even when JWT authentication is in use, triggered via a crafted image upload parameter. The presence of an active JWT implementation provides false assurance here — exploitation leads to remote code execution. Organizations using self-hosted ONLYOFFICE for document collaboration should immediately restrict file upload functionality, review server-side logs for /.. traversal patterns, and apply the vendor patch without delay.

CVE-2023-22894 in Strapi exposes sensitive user information through query filter abuse accessible from the admin panel, and CISA explicitly notes it chains with CVE-2023-22621 to achieve full remote code execution. Strapi is a widely deployed headless CMS in modern API-first architectures; if your instance is at or near end-of-life, the required action is migration, not just patching. Audit admin panel access logs for unusual query activity and rotate all API tokens and admin credentials now.

Finally, CVE-2026-102489 in Zammad presents a session fixation vulnerability leading to RCE as the zammad user, and chains with CVE-2026-102490. Zammad's role as a helpdesk and ticketing platform means that a compromised instance exposes internal communications, customer data, and potentially privileged credentials submitted via support workflows. Patch immediately, invalidate all active sessions, and review recent ticket activity for social engineering indicators.

Sources: CISA KEV Catalog · CISA BOD 26-04 · Ivanti Security Advisories · Citrix Security Bulletins · Apache Struts Security Reports · ISC BIND Security Matrix · ProFTPD Announcements · Strapi Security Advisories · ONLYOFFICE Security · Zammad Security