A 2016 Flaw Still Works: Why Nation-State Attackers Keep Hitting Unpatched Systems

A vulnerability disclosed a decade ago can still be a path into an organization today. That is the urgent lesson from a joint advisory published October 8, 2026, by CISA, the FBI, the NSA, and international partners: Chinese government-linked threat actors are combining automated scanning with hands-on techniques to target organizations worldwide, including U.S. critical infrastructure.

The advisory names activity consistent with threat clusters including Flax Typhoon, Ethereal Panda, and Red Juliett, while cautioning that public threat-group labels do not always map directly to government assessments. The practical takeaway is clearer: attackers are actively exploiting old, known vulnerabilities, and they do not need a zero-day when exposed, unpatched systems are still within reach.

FOUR OLD FLAWS. ONE CURRENT EXPOSURE PROBLEM.

Alongside its advisory, CISA added several vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog. Four of them affect software flaws disclosed years ago:

Apache Struts, CVE-2016-3081: A command-injection vulnerability that can enable remote code execution in affected versions under specific conditions.
ProFTPD, CVE-2015-3306: An access-control flaw associated with unauthorized file access.
ISC BIND, CVE-2015-5477: A flaw in affected BIND 9.x versions that can allow remote denial of service.
Strapi, CVE-2023-22894: An information-disclosure vulnerability affecting Strapi versions up to 4.5.5.

The advisory lists these among vulnerabilities successfully exploited in the activity it describes. That does not mean every organization is vulnerable to every CVE, or that all were used in every intrusion. It does mean defenders should verify whether affected software exists in their own environments, and act accordingly.

The CISA advisory includes this MicroScan dashboard as an example of tooling used to identify vulnerabilities.

The problem is not simply that old vulnerabilities exist. It is that organizations can lose track of where vulnerable software is running, who owns it, whether it is exposed to the internet, and what business function depends on it. A patch program cannot protect an asset the organization does not know it has.

WHY LEGACY SYSTEMS STAY ONLINE

Most organizations do not leave old systems exposed because they want to take unnecessary risks. They inherit a mix of operational constraints and visibility gaps:

Unsupported operating systems remain in place because replacing them requires budget, planning, and application testing.
Business-critical applications may rely on older software that nobody wants to disrupt without a tested migration path.
Forgotten appliances and servers can remain connected long after the project or employee that installed them is gone.
Shadow IT introduces unapproved tools, cloud services, and devices outside normal security processes.
Incomplete asset inventories make it hard to know what exists, where it is, and whether it is reachable from the internet.

These systems are easy to overlook during routine patching. They may not appear in a standard endpoint-management console. They might be managed by a vendor, run in a separate network, or have been quietly left in service because “nothing can be changed” without breaking a critical workflow.

That uncertainty is itself a security exposure. If a team cannot confidently identify its assets, it cannot reliably determine which ones are vulnerable or prioritize fixes based on business risk.

PATCH MANAGEMENT IS NOT EXPOSURE MANAGEMENT

Patch management is essential. It tracks updates and helps close known software weaknesses. But it is only one part of exposure management.

Patch management asks: What updates are available for the systems we know about?

Exposure management asks: What assets do we have, what is exposed, which weaknesses are being exploited, and what should we address first?

The distinction matters when attackers use automated scanning to find systems on the public internet, then shift to hands-on exploitation. A quarterly scan or one-time inventory can miss newly connected assets, changed configurations, or systems that were never included in the original scope.

An effective exposure-management program connects the dots between:

Asset discovery: Identify endpoints, servers, cloud workloads, web applications, and internet-facing systems.
Vulnerability identification: Determine which assets have known vulnerabilities and whether affected software is present.
Risk prioritization: Weigh exploit activity, exposure, asset importance, and business context, not just a severity score.
Remediation and validation: Coordinate fixes, track exceptions, and confirm that remediation worked.
Ongoing monitoring: Watch for suspicious activity that could signal attempted exploitation or a compromise already in progress.

Continuous discovery makes the difference. It helps organizations find unmanaged assets before those assets become unaddressed entry points.

WHAT TO DO NOW

Use the October 8 advisory as a prompt to verify, not assume, your exposure. Start with these steps:

Review your inventory for Apache Struts, ProFTPD, ISC BIND, and Strapi, including older and business-critical systems.
Check affected versions and exposure. Confirm whether vulnerable software is present and whether it can be reached from the internet or less-trusted network segments.
Prioritize remediation. Apply vendor updates where available. If a system cannot be patched immediately, assess compensating measures such as restricting access, disabling unused services, or isolating the asset.
Investigate unknown systems. Identify who owns them, what they support, and whether they are still required.
Strengthen access controls. CISA recommends measures including multifactor authentication, strong account controls, and disabling unused services and ports.
Monitor for suspicious activity. The advisory provides indicators of compromise and detection guidance; use them to support investigation and threat hunting where appropriate.
Plan to replace end-of-life systems. Temporary safeguards reduce exposure, but unsupported technology needs a documented replacement or retirement plan.

If you suspect a system has been compromised, do not treat patching as the entire response. Preserve relevant evidence, assess the scope, and follow an incident-response process before making changes that could destroy useful forensic data.

DISCOVER THE ASSETS YOU CAN’T AFFORD TO MISS

Cenova Cyber’s Vulnerability Management as a Service (VMaaS) combines asset discovery, vulnerability scanning, risk-based prioritization, and guided remediation. The goal is to help your team see what is present, understand what matters most, and track work through validation, not just receive a list of findings.

When a vulnerability is exploited, visibility and response matter as much as prevention. Cenova Cyber’s security monitoring service provides 24/7 SOC monitoring to investigate and contextualize security activity, so your team has support beyond patch cycles.

Request a free exposure and asset inventory review. We’ll help you identify what is visible, where important gaps may exist, and which next steps can reduce risk. Contact Cenova Cyber to start the conversation.