CISA Adds Five Vulnerabilities to KEV Catalog Following Flax Typhoon Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added five security flaws to its Known Exploited Vulnerabilities (KEV) catalog, following their abuse by a China-linked threat actor known as Flax Typhoon. The move triggers mandatory remediation timelines for civilian federal executive branch agencies.

The five vulnerabilities added are:
- CVE-2015-3306 (CVSS score: 10.0) - An improper access control vulnerability in ProFTPD that could allow unauthorized access.
- CVE-2025-21335 (Windows MSHTML Platform)
- CVE-2025-21333 (Windows Win32k)
- CVE-2025-21334 (Windows HTTP Protocol Stack)
- CVE-2025-21336 (Windows Kernel)

CISA Director Jen Easterly stated that the addition of these vulnerabilities to the KEV catalog confirms active exploitation in the wild. Federal agencies are required to patch all listed vulnerabilities by October 11, 2026. The KEV catalog addition is based on confirmed evidence of active exploitation by Flax Typhoon, a threat actor assessed to be operating out of China.

The vulnerabilities affect widely deployed enterprise software and operating system components. ProFTPD is a popular open-source FTP server, while the Windows flaws impact the MSHTML rendering engine, the Win32k kernel subsystem, the HTTP protocol stack, and the Windows kernel itself. Successful exploitation could allow remote code execution, privilege escalation, and full system compromise.

CISA has not disclosed specific technical details of the exploitation methods but confirmed that the actor has been actively leveraging these flaws. The October 11 deadline aligns with CISA's standard remediation window for KEV-listed vulnerabilities. Organizations are advised to prioritize patching these flaws to reduce the risk of compromise.