CISA Adds Five Flax Typhoon-Exploited Flaws to KEV, Sets October 11 Federal Deadline

Summary

CISA added five vulnerabilities exploited in activity linked to Flax Typhoon to its KEV catalog. Federal agencies must patch them or stop using affected products by October 11, 2026.

Key points

• CISA added five security flaws to its Known Exploited Vulnerabilities catalog following their exploitation by Flax Typhoon.
• A joint advisory from authorities in seven countries described operations targeting eight vulnerabilities, including the five newly added to KEV.
• The activity reportedly uses scanning tools, cross-site scripting, and password spraying against Microsoft Exchange for initial access.
• Attackers reportedly establish persistence through VPN software and use scripts to exfiltrate emails and credentials.
• The three other vulnerabilities in the joint advisory were already listed in KEV.
• Federal agencies must apply patches or discontinue use of affected products by October 11, 2026. The article does not name the vulnerabilities or affected products.

MITRE ATT&CK

People

Threat Actors

Products

Countries

Related Articles

• FBI Seizes Domains Used by China-Linked Hackers to Target Critical InfrastructureFlax Typhoon · Microsoft Exchange Server · T1110.003
• Four More U.S. States Sue TP-Link Over Router Security and China TiesFlax Typhoon · T1110.003
• Investigation Details Intrusion Targeting 12 Omani Government Entities, With 26,000 Records ExtractedMicrosoft Exchange Server · T1110.003
• CYFIRMA Report Finds Rising Ransomware and APT Activity Targeting Real Estate and ConstructionMicrosoft Exchange Server
• Why the SMB1001 Cybersecurity Standard Is Designed for Small BusinessesMicrosoft Exchange Server