<![CDATA[🔴 Critical: Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies]]>The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added five security flaws to its Known Exploited Vulnerabilities (KEV) catalog after they were abused by a China-linked threat actor tracked as Flax Typhoon.

Among the entries is CVE-2015-3306, a critical improper access control vulnerability in ProFTPD carrying a CVSS score of 10.0. The flaw could allow attackers to compromise affected systems, and its presence in the KEV catalog confirms it has been exploited in the wild.

Federal agencies are required to remediate the listed vulnerabilities by October 11, per the binding operational directive tied to the KEV catalog.

Affected organizations should review their exposure to the following:

  • ProFTPD — CVE-2015-3306 (CVSS 10.0), improper access control

Given that Flax Typhoon is actively exploiting these flaws, defenders are urged to prioritize patching and to check for signs of compromise on any internet-facing services running the affected software.

Source: The Hacker News

Has your organization reviewed its KEV catalog obligations ahead of the October 11 deadline, and are any of your internet-facing services running the affected software?

]]>https://xploitlk.com/topic/641/critical-flax-typhoon-exploits-five-flaws-as-cisa-sets-october-11-deadline-for-federal-agenciesRSS for NodeTue, 27 Oct 2026 08:53:46 GMTSat, 10 Oct 2026 22:30:19 GMT60