# CISA Requires Agencies to Remediate Five Flaws

CISA added actively exploited vulnerabilities affecting ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND to its Known Exploited Vulnerabilities catalog. Under Binding Operational Directive 22-01, federal civilian agencies must remediate the affected products or discontinue their use by **October 11, 2026—one day from October 10**. The signals identify no solicitation, contract award, or funding opportunity, but contractors supporting federal systems may be needed to help agencies find exposed products, patch or retire them, and investigate related intrusion indicators.

- Contractors should promptly check the federal environments they support for the five affected products and coordinate remediation with agency customers.
- Companies providing asset discovery, vulnerability remediation, or incident response should assess whether their existing support can help agencies meet the deadline; contractors should also confirm any applicable contract-specific security and reporting obligations.
- Agencies and contractors should distinguish this mandatory federal-agency directive from any separate obligations that apply to contractors under their contracts.

**Jurisdictions:** federal
**Industries:** Information Technology, Public Safety
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 09, 2026

### Government Entities
- Cybersecurity and Infrastructure Security Agency (CISA)
- Federal civilian agencies

### Key Quotes
> hackers affiliated with the Chinese government continue to position themselves within critical infrastructure networks, including operational technology (OT) systems, with the goal of disrupting critical operations at a future time of their choosing.
> — Chris Butera, Deputy Executive Director for Cybersecurity, CISA

### Sources
- [Flax Typhoon exploits five vulnerabilities](https://www.secnews.gr/en/739277/flax-typhoon-ekmetalleutai-eupatheies) - SecNews.gr
- [CISA Orders Federal Agencies to Patch Five Exploited Flaws by October 11 Amid Flax Typhoon Campaign — BigGo Finance](https://finance.biggo.com/news/f8e5b44f-988b-4edc-b409-10b6318f541c) - finance.biggo.com
- [CISA orders federal agencies to patch five flaws exploited by Flax Typhoon by Oct. 11 | LavX News](https://news.lavx.hu/article/cisa-orders-federal-agencies-to-patch-five-flaws-exploited-by-flax-typhoon-by-oct-11) - news.lavx.hu