CISA Flags Five Exploited Flaws in ProFTPD, ONLYOFFICE, Strapi, Apache, ISC

En bref

• Five security defects tied to widely used server and collaboration tools now carry a federal patch warning.
• The named products are ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND.
• The flaws are already being exploited, so exposure carries immediate risk.
• School and government IT teams should inventory and patch affected deployments without delay.

The U.S. cyber agency CISA has expanded its federal catalog of flaws that attackers are already abusing, adding five entries tied to ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND. That designation matters because it means these are not hypothetical weaknesses; they have been observed in real-world exploitation. Exact CVE identifiers were not included in the details available, so administrators should check CISA's official catalog for precise references, affected versions, and any required remediation timeline.

These products sit in different parts of a typical technology stack. ProFTPD handles file transfers, ONLYOFFICE Docs supports collaborative document editing, Strapi powers content APIs, Apache Struts runs Java web applications, and ISC BIND resolves domain names. A compromise in any one of them could expose sensitive data, disrupt services, or give an intruder a foothold for lateral movement. K-12 districts and government agencies often run these tools behind the scenes, sometimes on internet-facing servers with limited dedicated security staff.

Because exploitation is already occurring, the normal patch cycle is too slow. Federal civilian agencies typically face binding deadlines after such catalog updates, and state, local, and education organizations often adopt the same urgency as a best practice. Attackers scan broadly for vulnerable versions, so an unpatched service can be found and targeted before a district even knows it is exposed. DNS and web framework components are especially consequential because many other applications depend on them.

IT teams should treat this as a high-priority patching event. Watch for vendor advisories, CISA updates, and signs of scanning or unusual access against the five named products. If immediate patching is not possible, reduce exposure by restricting access, disabling unnecessary features, and monitoring logs closely. Verify that backups are isolated and recoverable, and be prepared to rotate credentials if compromise is suspected.

À faire maintenant

1. Inventory every instance of ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND, noting which systems are internet-facing.
2. Apply vendor-supplied updates or mitigations immediately; if no fix exists, isolate or disable the affected service until one is available.
3. Check CISA's official catalog for the exact five entries and any remediation deadlines, then map them to your asset inventory.
4. Restrict network access to these services using firewalls, VPNs, or zero-trust rules, and remove unnecessary public exposure.
5. Review logs for exploitation attempts and unusual behavior around file transfer, document editing, CMS APIs, Java web apps, and DNS.
6. Rotate credentials and secrets for affected systems if compromise is suspected, and confirm backups are clean and restorable.
7. Brief IT and application owners, and schedule emergency patching for any unpatched internet-facing instance.

Source originale

Security Affairs