CVE-2021-3199Vulnerability

1. “CVE-2021-3199 (CVSS score of 9.8) – A path traversal flaw in ONLYOFFICE Docs when JSON Web Token (JWT) is enabled.”

   Security AffairsNews11 Oct 2026
   U.S. CISA adds ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND flaws to its Known Exploited Vulnerabilities catalog

2. “CVE-2021-3199 (CVSS score: 9.8) - A path traversal vulnerability in ONLYOFFICE Docs that can occur when JSON Web Token (JWT) is used, via a "/.." sequence in an image upload parameter and could allow for remote code execution.”

   The Hacker NewsNews9 Oct 2026
   Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies

3. “…Security Agency (CISA) has added five CVEs to its Known Exploited Vulnerabilities Catalog: CVE-2015-3306 CVE-2015-5477 CVE-2016-3081 CVE-2021-3199 CVE-2023-22894 The court-authorized seizures are the latest in a long series of US law-enforcement attempts to disrupt a Beijing-back…”

   The Register (security)News8 Oct 2026
   US disrupts Chinese hacking tools as 7 govts warn of PRC spies stealing sensitive data worldwide

4. “CVE-2021-3199*”

   The Hacker NewsNews8 Oct 2026
   FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails

5. “CVE-2021-3199”

   CISA advisoriesGovernment8 Oct 2026
   Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data

• dns.studiocloud[.]xyzin 1 report
• natcloudservice[.]comin 1 report
• 2.3.20[.]2in 1 report
• 2.3.24[.]1in 1 report
• 2.3.20[.]3in 1 report
• 2.3.24[.]3in 1 report
• 2.3.28[.]1in 1 report
• c0cc[.]ccin 1 report
• 98aicai[.]comin 1 report
• 98aicode[.]comin 1 report
• outlook3650[.]comin 1 report
• youtubecard[.]comin 1 report
• linkedinns[.]netin 1 report

Also named with it: CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2023-22894, CVE-2019-11510, CVE-2014-6278, CVE-2021-22205