CISA has added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after the flaws were reportedly abused by the China-linked threat actor Flax Typhoon. The U.S. agency also set an October 11 remediation deadline for U.S. federal civilian agencies under its Binding Operational Directive process.

That deadline does not apply to private companies in Europe. However, inclusion in the KEV catalog is widely treated as a strong signal that a vulnerability is not only public, but being actively exploited in real-world attacks. For European businesses, that makes this update relevant as a practical patching and exposure-management alert.

What happened

According to the report, CISA added five security flaws to the KEV catalog following observed exploitation linked to Flax Typhoon. KEV entries are used by U.S. federal agencies to prioritise remediation of vulnerabilities that have confirmed exploitation activity.

The source indicates that one of the listed issues is CVE-2015-3306, an improper access control vulnerability in ProFTPD. Older vulnerabilities can remain operationally dangerous when legacy systems are still internet-accessible or patching has been delayed.

CISA's deadline is aimed at federal agencies in the United States, not European businesses. Still, KEV additions often influence vulnerability-prioritisation decisions well beyond the U.S. public sector because they help security teams focus on flaws that attackers are actively using rather than theoretical risks.

Why it matters for European businesses

For European companies, the main issue is not the U.S. government deadline itself, but the signal behind it: active exploitation. Businesses with public-facing servers, legacy applications, unmanaged hosting environments or fragmented patching processes may face elevated risk if any of the affected software is present in their estate.

This matters particularly for SMEs that rely on older infrastructure, third-party hosting, outsourced IT support or inherited systems that have not been fully modernised. In many organisations, older file transfer, web or remote administration services remain exposed longer than expected.

There is also a governance angle. Companies operating under stronger cybersecurity expectations, including those preparing for or affected by NIS2-related requirements at national level, are under growing pressure to demonstrate timely vulnerability management, asset visibility and incident readiness.

KEV-style intelligence can help security and IT teams decide what to patch first when resources are limited. In practice, a confirmed exploited flaw should typically rank above vulnerabilities that are severe on paper but not yet linked to active attacks.

Who may be affected

• SMEs with internet-facing servers such as FTP, web, VPN or remote management services
• Companies running legacy software that may include unsupported or rarely reviewed components
• E-commerce and digital businesses where website uptime, customer data and backend systems are business-critical
• IT service providers and digital agencies managing infrastructure for multiple clients
• Organisations in regulated or security-sensitive sectors that need stronger evidence of risk-based remediation processes

What companies should consider

• Check whether any affected products are in use across production, staging and forgotten legacy environments
• Prioritise remediation based on exploitation status, not only CVSS severity scores
• Review internet-exposed services and remove or restrict access to software that is no longer required
• Validate patching ownership where systems are managed by hosting providers, MSPs or external development partners
• Look for signs of compromise if vulnerable systems have been exposed, especially on older infrastructure
• Improve asset inventory so outdated services can be identified before external alerts force urgent action

For European business leaders, the broader lesson is straightforward: actively exploited vulnerabilities should trigger immediate review, even when the formal deadline comes from a U.S. agency and applies only to federal bodies. The practical risk for private-sector organisations lies in delayed patching, poor visibility over exposed assets and continued dependence on legacy systems.