Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies

CISA added five high-severity vulnerabilities to its Known Exploited Vulnerabilities catalog after they were abused by the China-linked actor Flax Typhoon; the report lists CVE-2015-3306, CVE-2021-3199, CVE-2023-22894, CVE-2016-3081, and CVE-2015-5477 (with several high CVSS scores) and ties the activity to a broader campaign attributed to Integrity Technology Group that uses scanning, XSS, password spraying, VPN-based persistence, and scripts to exfiltrate emails and credentials — federal agencies were ordered to patch or discontinue affected systems by October 11, 2026.