{"metadata": {"vulnerability": "CVE-2021-3199", "count": 44, "kinds": {"milestone": 4, "sighting": 13, "kev": 11, "other": 16}}, "data": [{"timestamp": "2021-01-21T00:00:00Z", "date_only": false, "value": "2021-01-21T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2021-3199", "field": "cveMetadata.dateReserved"}, {"timestamp": "2021-01-22T02:41:34Z", "date_only": false, "value": "2021-01-22T02:41:34.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2021-3199", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2021-01-26T18:16:00Z", "date_only": false, "value": "2021-01-26T18:16:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-VM8R-R39C-96C6", "record": "GHSA-VM8R-R39C-96C6", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2021-01-26T18:16:00Z", "date_only": false, "value": "2021-01-26T18:16Z", "kind": "other", "label": "Published Date", "source": "gsd \u00b7 GSD-2021-3199", "record": "GSD-2021-3199", "field": "namespaces.nvd.nist.gov.publishedDate", "linked_record": true}, {"timestamp": "2021-01-26T18:16:28.507Z", "date_only": false, "value": "2021-01-26T18:16:28.507", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-3199", "record": "FKIE_CVE-2021-3199", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2021-02-01T00:00:00Z", "date_only": true, "value": "2021-02-01", "kind": "other", "label": "Submit Time", "source": "cnvd \u00b7 CNVD-2021-17251", "record": "CNVD-2021-17251", "field": "submitTime", "linked_record": true}, {"timestamp": "2021-03-13T00:00:00Z", "date_only": true, "value": "2021-03-13", "kind": "other", "label": "Open Time", "source": "cnvd \u00b7 CNVD-2021-17251", "record": "CNVD-2021-17251", "field": "openTime", "linked_record": true}, {"timestamp": "2022-03-21T20:03:15Z", "date_only": false, "value": "2022-03-21T20:03:15.000Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / mitre", "record": "CVE-2021-3199", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2022-04-15T16:25:00Z", "date_only": false, "value": "2022-04-15T16:25Z", "kind": "other", "label": "Last Modified Date", "source": "gsd \u00b7 GSD-2021-3199", "record": "GSD-2021-3199", "field": "namespaces.nvd.nist.gov.lastModifiedDate", "linked_record": true}, {"timestamp": "2022-05-24T17:40:23Z", "date_only": false, "value": "2022-05-24T17:40:23Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-VM8R-R39C-96C6", "record": "GHSA-VM8R-R39C-96C6", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2023-12-13T01:23:35.067Z", "date_only": false, "value": "2023-12-13T01:23:35.067575Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2021-3199", "record": "GSD-2021-3199", "field": "gsd.osvSchema.modified", "linked_record": true}, {"timestamp": "2024-08-03T16:45:51.411Z", "date_only": false, "value": "2024-08-03T16:45:51.411Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2021-3199", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-08T00:00:00Z", "date_only": false, "value": "2026-10-08T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2021-3199", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "c8c93212-d627-4840-a6e9-4a4e261fe139", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-08T00:00:00Z", "date_only": true, "value": "2026-10-08", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2021-3199", "field": "containers.adp.1.metrics.2.other.content.dateAdded"}, {"timestamp": "2026-10-08T00:00:00Z", "date_only": true, "value": "2026-10-08", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2021-3199", "field": "evidence.0.details.date_added", "uuid": "c8c93212-d627-4840-a6e9-4a4e261fe139", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-08T00:00:00Z", "date_only": false, "value": "2026-10-08T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2021-3199", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "c8c93212-d627-4840-a6e9-4a4e261fe139", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-08T00:00:00Z", "date_only": false, "value": "2026-10-08T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2021-3199", "field": "containers.adp.1.metrics.1.other.content.timestamp"}, {"timestamp": "2026-10-08T00:00:00Z", "date_only": false, "value": "2026-10-08T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-3199", "record": "FKIE_CVE-2021-3199", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-10-08T00:00:00Z", "date_only": false, "value": "2026-10-08T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2021-3199", "field": "status.status_updated_at", "uuid": "c8c93212-d627-4840-a6e9-4a4e261fe139", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-08T00:00:00Z", "date_only": false, "value": "2026-10-08T00:00:00.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2021-3199", "field": "containers.adp.1.timeline.0.time", "text": "CVE-2021-3199 added to CISA KEV"}, {"timestamp": "2026-10-08T17:40:54Z", "date_only": false, "value": "2026-10-08T17:40:54+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2021-3199", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "b595ae6e-79f5-4edb-ba91-cbc3b9b8c12f", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-08T17:40:54Z", "date_only": false, "value": "2026-10-08T17:40:54+00:00", "kind": "kev", "label": "First seen", "source": "previdian", "record": "CVE-2021-3199", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "b595ae6e-79f5-4edb-ba91-cbc3b9b8c12f", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-08T17:40:54Z", "date_only": false, "value": "2026-10-08T17:40:54+00:00", "kind": "kev", "label": "Status updated", "source": "previdian", "record": "CVE-2021-3199", "field": "status.status_updated_at", "uuid": "b595ae6e-79f5-4edb-ba91-cbc3b9b8c12f", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-08T17:40:54.331Z", "date_only": false, "value": "2026-10-08T17:40:54.331Z", "kind": "kev", "label": "Catalog added", "source": "previdian", "record": "CVE-2021-3199", "field": "evidence.0.details.added_date", "uuid": "b595ae6e-79f5-4edb-ba91-cbc3b9b8c12f", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-08T18:00:01Z", "date_only": false, "value": "2026-10-08T18:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2021-3199", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "c8c93212-d627-4840-a6e9-4a4e261fe139", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-08T18:00:02.751Z", "date_only": false, "value": "2026-10-08T18:00:02.751135Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/c8c93212-d627-4840-a6e9-4a4e261fe139", "record": "CVE-2021-3199", "field": "creation_timestamp", "uuid": "d3137377-d074-45db-931a-f52c1391f236", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/c8c93212-d627-4840-a6e9-4a4e261fe139", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-08T18:00:31.977Z", "date_only": false, "value": "2026-10-08T18:00:31.977259Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mxf22yrrpq26", "record": "CVE-2021-3199", "field": "creation_timestamp", "uuid": "742db593-b709-4eb8-a1f4-d370c9cd8abd", "content": "\ud83d\uded1 CVE-2021-3199\nONLYOFFICE Docs\nCVSS 9.8 / EPSS 8% / KEV: No\nTL;DR: Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Se\u2026\nhttps://cvesentinel.com/report/CVE-2021-3199?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mxf22yrrpq26"}, {"timestamp": "2026-10-08T18:20:05.205Z", "date_only": false, "value": "2026-10-08T18:20:05.205107Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aipostdaily.bsky.social/post/3mxf35wyhky2l", "record": "CVE-2021-3199", "field": "creation_timestamp", "uuid": "f2bb22ee-7473-482c-9a8e-fd3fa362cf10", "content": "CISA added CVE-2021-3199 to its Known Exploited Vulnerabilities list (2026-10-08).\nONLYOFFICE Docs Server Path Traversal\nEPSS 30 days before listing: 0.082 \u00b7 today: 0.082\n#infosec #KEV", "url": "https://bsky.app/profile/aipostdaily.bsky.social/post/3mxf35wyhky2l"}, {"timestamp": "2026-10-08T18:31:47Z", "date_only": false, "value": "2026-10-08T18:31:47Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-VM8R-R39C-96C6", "record": "GHSA-VM8R-R39C-96C6", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-08T19:15:57.932Z", "date_only": false, "value": "2026-10-08T19:15:57.932667Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ninjaintelgroup.bsky.social/post/3mxf6bvfdsc2a", "record": "CVE-2021-3199", "field": "creation_timestamp", "uuid": "eb321fa6-6426-4183-aedf-597ccce65990", "content": "\ud83d\udea8 NEW on CISA KEV \u2014 exploited in the wild\nONLYOFFICE Docs: ONLYOFFICE Docs Server Path Traversal Vulnerability\nCVE-2021-3199 \u00b7 patch by 2026-10-11\n\ud83d\udd17 https://ninjasignal.ninja/intel/cve/CVE-2021-3199\n#KEV #cybersecurity #infosec", "url": "https://bsky.app/profile/ninjaintelgroup.bsky.social/post/3mxf6bvfdsc2a"}, {"timestamp": "2026-10-08T20:05:51.126Z", "date_only": false, "value": "2026-10-08T20:05:51.126281Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/secdb/statuses/117406827249675241", "record": "CVE-2021-3199", "field": "creation_timestamp", "uuid": "6a60eb96-7508-4624-a84a-d983b928efb7", "content": "\ud83d\udea8 [CISA-2026:1008] CISA Adds 5 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1008)\nCISA has added 5 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.\n\u26a0\ufe0f CVE-2015-3306 (https://secdb.nttzen.cloud/cve/detail/CVE-2015-3306)- Name: ProFTPD Improper Access Control Vulnerability- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.- Known To Be Used in Ransomware Campaigns? Unknown- Vendor: ProFTPD- Product: ProFTPD- Notes: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: http://www.proftpd.org/ ; https://lists.debian.org/debian-security-announce/2015/msg00154.html ; https://lists.opensuse.org/archives/list/updates@lists.opensuse.org/message/WE6YZRG5UVXMGQ7IVDRYBPIWV4M6UUGM/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2015-3306\n\u26a0\ufe0f CVE-2015-5477 (https://secdb.nttzen.cloud/cve/detail/CVE-2015-5477)- Name:  ISC BIND Data Processing Errors Vulnerability- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.- Known To Be Used in Ransomware Campaigns? Unknown- Vendor: ISC- Product: BIND- Notes: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://web.archive.org/web/20150729014733/https://kb.isc.org/article/AA-01272 ; https://access.redhat.com/errata/RHSA-2015:1513.html; https://supportportal.juniper.net/s/article/2016-01-Security-Bulletin-Junos-Vulnerability-in-ISC-BIND-named-CVE-2015-5477 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2015-5477\n\u26a0\ufe0f CVE-2016-3081 (https://secdb.nttzen.cloud/cve/detail/CVE-2016-3081)- Name: Apache Struts Command Injection Vulnerability- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.- Known To Be Used in Ransomware Campaigns? Unknown- Vendor: Apache- Product: Struts- Notes: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://cwiki.apache.org/confluence/display/WW/S2-032 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2016-3081\n\u26a0\ufe0f CVE-2021-3199 (https://secdb.nttzen.cloud/cve/detail/CVE-2021-3199)- Name: ONLYOFFICE Docs Server Path Traversal Vulnerability- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.- Known To Be Used in Ransomware Campaigns? Unknown- Vendor: ONLYOFFICE- Product: Docs- Notes: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: ; https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2021-3199\n\u26a0\ufe0f CVE-2023-22894 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-22894)- Name: Strapi Cleartext Storage of Sensitive Information Vulnerability- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.- Known To Be Used in Ransomware Campaigns? Unknown- Vendor: Strapi- Product: Strapi- Notes: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve ; https://github.com/strapi/strapi/releases ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2023-22894\n#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20261008 #cisa20261008 #cve_2015_3306 #cve_2015_5477 #cve_2016_3081 #cve_2021_3199 #cve_2023_22894 #cve20153306 #cve20155477 #cve20163081 #cve20213199 #cve202322894", "url": "https://infosec.exchange/users/secdb/statuses/117406827249675241"}, {"timestamp": "2026-10-09T03:55:31.111Z", "date_only": false, "value": "2026-10-09T03:55:31.111Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2021-3199", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-09T03:55:31.111Z", "date_only": false, "value": "2026-10-09T03:55:31.111Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2021-3199", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-09T06:13:48Z", "date_only": false, "value": "2026-10-09T06:13:48+00:00", "kind": "kev", "label": "Recorded", "source": "previdian", "record": "CVE-2021-3199", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "b595ae6e-79f5-4edb-ba91-cbc3b9b8c12f", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-09T06:14:13.039Z", "date_only": false, "value": "2026-10-09T06:14:13.039320Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b595ae6e-79f5-4edb-ba91-cbc3b9b8c12f", "record": "CVE-2021-3199", "field": "creation_timestamp", "uuid": "902f16cc-b4c2-4d9b-9d54-dcb164e371e1", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b595ae6e-79f5-4edb-ba91-cbc3b9b8c12f", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-09T06:31:18.185Z", "date_only": false, "value": "2026-10-09T06:31:18.185328Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/threatspotai.bsky.social/post/3mxgdzigqcw2x", "record": "CVE-2021-3199", "field": "creation_timestamp", "uuid": "ce53c991-757d-4a34-86d7-f2322c306af9", "content": "\ud83d\udea8 CISA KEV Alert\nCVE-2021-3199: \u26a0\ufe0f CVE-2021-3199: New Actively Exploited Vulnerability Added to CISA KEV\nSeverity: HIGH | CVSS: 0.0 | EPSS: 8.2%\nActively exploited\n\nRead the full alert: https://threatspot.ai/alerts/2021-3199-directory-traversal-with-remote-code-execution", "url": "https://bsky.app/profile/threatspotai.bsky.social/post/3mxgdzigqcw2x"}, {"timestamp": "2026-10-09T07:29:18.122Z", "date_only": false, "value": "2026-10-09T07:29:18.122954Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybowl.bsky.social/post/3mxghb6xttr2g", "record": "CVE-2021-3199", "field": "creation_timestamp", "uuid": "6270f4e7-591c-4205-9f11-382d85ce7fc9", "content": "\ud83d\udd34 Exploitation confirm\u00e9e (CISA KEV, ajouts du 08/10) \u00b7 5\n\u2022 ProFTPD CVE-2015-3306, CVSS 10.0\n\u2022 ISC BIND CVE-2015-5477, CVSS 7.5\n\u2022 Apache Struts CVE-2016-3081, CVSS 8.1\n\u2022 ONLYOFFICE Docs CVE-2021-3199, CVSS 9.8\n\u2022 Strapi CVE-2023-22894, CVSS 4.9", "url": "https://bsky.app/profile/cybowl.bsky.social/post/3mxghb6xttr2g"}, {"timestamp": "2026-10-09T09:06:52.774Z", "date_only": false, "value": "2026-10-09T09:06:52.774398Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/csirts.com/post/3mxgmpoar762b", "record": "CVE-2021-3199", "field": "creation_timestamp", "uuid": "e0f86139-da75-48ad-b087-a4d9cf3549bd", "content": "\ud83d\udea8 Added to CISA KEV \u2014 actively exploited:\nCVE-2021-3199: ONLYOFFICE Docs Server Path Traversal Vulnerability\n\nhttps://www.csirts.com/cve/CVE-2021-3199", "url": "https://bsky.app/profile/csirts.com/post/3mxgmpoar762b"}, {"timestamp": "2026-10-09T14:20:47.350Z", "date_only": false, "value": "2026-10-09T14:20:47.350", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-3199", "record": "FKIE_CVE-2021-3199", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-11T00:00:00Z", "date_only": true, "value": "2026-10-11", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2021-3199", "field": "evidence.0.details.due_date", "uuid": "c8c93212-d627-4840-a6e9-4a4e261fe139", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-12T12:35:19.848Z", "date_only": false, "value": "2026-10-12T12:35:19.848287Z", "kind": "sighting", "label": "Seen", "source": "https://vulnerability.circl.lu/bundle/160355e6-36c4-42a6-a839-70a2c2c3a87e", "record": "CVE-2021-3199", "field": "creation_timestamp", "uuid": "3eb82744-8d5d-4733-bb6e-ffd24e7935c5", "url": "https://vulnerability.circl.lu/bundle/160355e6-36c4-42a6-a839-70a2c2c3a87e"}, {"timestamp": "2026-10-12T12:53:03.585Z", "date_only": false, "value": "2026-10-12T12:53:03.585854Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mxokqtwga22l", "record": "CVE-2021-3199", "field": "creation_timestamp", "uuid": "06fc51ba-2ba0-46a2-8740-fb079336b30b", "content": "(CISA TS+SOC) The Cyber Mind TSUITE Brief: CVE-2021-3199 \u2013 ONLYOFFICE Docs Server Path Traversal\u00a0Vulnerability\n\nA strategic TSUITE intelligence brief covering CVE-2021-3199 ONLYOFFICE Docs path traversal and RCE, featuring SIEM detection queries, KEV compliance, and\u2026\n\nhttps://thecybermind.co/c3pw", "url": "https://bsky.app/profile/thecybermind.co/post/3mxokqtwga22l"}, {"timestamp": "2026-10-12T13:29:04.298Z", "date_only": false, "value": "2026-10-12T13:29:04.298953Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mxomras7bb2e", "record": "CVE-2021-3199", "field": "creation_timestamp", "uuid": "684783bd-bf21-4d8a-a0e7-7cee3b3b6fdb", "content": "(CISA CS-MAN) The Cyber Mind CSUITE Brief: CVE-2021-3199 \u2013 ONLYOFFICE Docs Server Path Traversal\u00a0Vulnerability\n\nA strategic C-Suite threat brief covering CVE-2021-3199 ONLYOFFICE Docs path traversal vulnerability, featuring active mitigation, asset inventory\u2026\n\nhttps://thecybermind.co/csty", "url": "https://bsky.app/profile/thecybermind.co/post/3mxomras7bb2e"}, {"timestamp": "2026-10-12T13:56:05.088Z", "date_only": false, "value": "2026-10-12T13:56:05.088164Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3mxoobl2glz3x", "record": "CVE-2021-3199", "field": "creation_timestamp", "uuid": "77ada68c-363d-4191-87d7-37397acb6ec0", "content": "CISA KEV | CVE-2021-3199 | ONLYOFFICE / Docs\n\nCISA lists this vulnerability as exploited in the wild. Check affected products and vendor guidance.\n\nSource: CISA KEV\n\nFull analysis: https://t.me/aiutocomputerhelp_lab/1237", "url": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3mxoobl2glz3x"}], "metrics": {"as_of": "2026-11-06T08:11:44.961Z", "anchors": {"origin": {"timestamp": "2021-01-22T02:41:34Z", "date_only": false, "value": "2021-01-22T02:41:34.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2021-3199", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2021-01-22T02:41:34Z", "date_only": false, "value": "2021-01-22T02:41:34.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2021-3199", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": {"timestamp": "2026-10-08T00:00:00Z", "date_only": false, "value": "2026-10-08T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2021-3199", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "c8c93212-d627-4840-a6e9-4a4e261fe139", "status": {"status_reason": "confirmed", "exploited": true}}, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": true, "seconds": 180134306.0, "hours": 50037.307222222225, "days": 2084.887800925926, "min_seconds": 180134306.0, "max_seconds": 180220706.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2021-01-22T02:41:34Z", "date_only": false, "value": "2021-01-22T02:41:34.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2021-3199", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-08T00:00:00Z", "date_only": false, "value": "2026-10-08T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2021-3199", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "c8c93212-d627-4840-a6e9-4a4e261fe139", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit": {"available": true, "seconds": 180134306.0, "hours": 50037.307222222225, "days": 2084.887800925926, "min_seconds": 180134306.0, "max_seconds": 180220706.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2021-01-22T02:41:34Z", "date_only": false, "value": "2021-01-22T02:41:34.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2021-3199", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-08T00:00:00Z", "date_only": false, "value": "2026-10-08T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2021-3199", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "c8c93212-d627-4840-a6e9-4a4e261fe139", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 182669410.961907, "hours": 50741.50304497417, "days": 2114.2292935405903, "min_seconds": 182669410.961907, "max_seconds": 182669410.961907, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2021-01-22T02:41:34Z", "date_only": false, "value": "2021-01-22T02:41:34.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2021-3199", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-06T08:11:44.961Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": true, "seconds": 2535104.961907, "hours": 704.1958227519444, "days": 29.34149261466435, "min_seconds": 2448704.961907, "max_seconds": 2535104.961907, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-08T00:00:00Z", "date_only": false, "value": "2026-10-08T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2021-3199", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "c8c93212-d627-4840-a6e9-4a4e261fe139", "status": {"status_reason": "confirmed", "exploited": true}}, "end": {"timestamp": "2026-11-06T08:11:44.961Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}