CISA Sets Oct. 11 Deadline for Patching Flaws Exploited by Flax Typhoon

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five vulnerabilities to its Known Exploited Vulnerabilities catalog after a China-linked group called Flax Typhoon exploited them for data breaches; federal agencies must patch or retire affected software by October 11, 2026. The listed CVEs (including CVE-2015-3306 and CVE-2021-3199) have high CVSS ratings and are tied to attacks facilitated by a China-based company, Integrity Technology Group, enabling vectors such as remote code execution and denial-of-service.