CISA Adds Five Flaws to KEV Catalog After Flax Typhoon Exploitation

· Cybersecurity · United States

The U.S. Cybersecurity and Infrastructure Security Agency added five security flaws to its Known Exploited Vulnerabilities catalog on Thursday, following their abuse by a China-linked threat actor known as Flax Typhoon, and set an October 11 deadline for federal agencies to remediate. The flaws include CVE-2015-3306, dated 2015 and rated a maximum CVSS score of 10.0. Separately, U.S. authorities have moved to disrupt Chinese state-sponsored hacking tools, with Flax Typhoon and other advanced persistent threat groups having used the MicroScan and FishHub toolsets to scan and compromise U.S. and foreign critical infrastructure. The actions tie a long-lived vulnerability to an active campaign and put federal remediation on a hard deadline.

Why it matters：KEV listings set the de facto federal patching clock and signal which flaws attackers are actively using, guiding prioritization well beyond U.S. government networks.

Key points

  • Five flaws added to the KEV catalog on Thursday, with an October 11 federal remediation deadline
  • Includes CVE-2015-3306, a 2015 flaw with a CVSS score of 10.0
  • Flax Typhoon used MicroScan and FishHub tools against U.S. and foreign critical infrastructure

Sources (original reporting)

More stories from this day