ONLYOFFICE Docs CVE-2021-3199 Hit CISA’s KEV: Patch Document Server Before Attackers Do

If your office runs a self-hosted document editor—ONLYOFFICE Document Server on a VM, in Docker, or behind Nextcloud—this is the week to confirm the build number and whether it is reachable from the internet. On Wednesday, October 8, CISA added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including CVE-2021-3199 in ONLYOFFICE Docs. The federal remediation due date was Saturday, October 11. The same day, CISA and partner agencies published joint advisory AA26-281A, which lists CVE-2021-3199 among vulnerabilities successfully exploited by China-linked threat actors enabled by Integrity Technology Group.

The detail that surprises most operators: CISA’s KEV description says the path traversal flaw can occur when JWT is used, via a /.. sequence in an image upload parameter, and can allow remote code execution. Many teams turn JWT on specifically to harden Document Server. Here is what New York City business owners and their IT teams need to know, using only what CISA, NIST, ONLYOFFICE’s changelog, and named security reporting have published.

What CVE-2021-3199 is, in plain terms

CVE-2021-3199 is a path traversal vulnerability (CWE-22) in ONLYOFFICE Document Server. Per the NIST National Vulnerability Database entry, directory traversal with remote code execution can occur in the upload path before version 5.6.3 when JWT is used, through a /.. sequence in an image upload parameter. CISA’s KEV catalog uses the same core wording and scores the operational risk high enough to require federal agencies to remediate within three days of listing.

Security Affairs reports a CVSS score of 9.8 for CVE-2021-3199. That Critical rating reflects network reachability, low attack complexity, and the potential for full compromise of the Document Server host—which often holds drafts, contracts, and shared workbooks for the whole firm.

ONLYOFFICE fixed the issue in Document Server 5.6.3. The vendor’s 5.6.3 changelog is the reference CISA points to in the KEV notes. If your instance is older than that build, treat it as in scope until you prove otherwise.

Why a 2021 bug showed up on the October 2026 KEV list

KEV is not a list of brand-new zero-days. It is CISA’s public list of flaws with evidence of exploitation in the wild. CVE-2021-3199 was published in January 2021. CISA added it on October 8, 2026, because defenders still find it being used. AA26-281A’s Appendix B marks CVE-2021-3199 with an asterisk as one of the CVEs newly added to the KEV catalog in connection with the Integrity Tech activity the advisory describes.

That advisory—issued jointly by CISA, the FBI, NSA, and partners in the United Kingdom, Australia, Canada, Japan, New Zealand, and Spain—describes China-linked actors who combine large-scale scanning (including a tool set tracked as MicroScan), hands-on exploitation, SoftEther VPN for persistence, and email and credential theft. The point for a private business is not geopolitics. It is that old, internet-facing collaboration software remains a productive hunting ground, and automated scanners do not care whether your firm has five seats or five thousand.

Who is actually exposed in an NYC SMB stack

ONLYOFFICE Document Server shows up in more small and mid-sized environments than many owners realize:

• Self-hosted office suites where staff edit Word, Excel, and PowerPoint files in the browser
• Nextcloud or similar file platforms with ONLYOFFICE as the online editor
• Internal “document portal” VMs stood up for a law firm, accounting practice, medical group, or real-estate office so files never leave the firm’s network—except when the Document Server port is accidentally published to the internet
• Docker Compose stacks that were installed once, JWT enabled from a how-to guide, and then left on an old image tag

If Document Server is reachable from the public internet, or from a broad partner VPN, prioritize it. If it only listens on an internal VLAN behind MFA and a jump host, still patch, but the urgency ranking is different. The KEV entry also carries forensic triage: Yes under BOD 26-04, which means federal agencies must check whether the system was hit before the patch. That is sensible practice for any firm that exposed Document Server outside a tight trust boundary.

The rest of the October 8 KEV batch (quick inventory)

CVE-2021-3199 did not arrive alone. CISA’s October 8 additions, summarized by East Bay Cyber and Security Affairs, also include:

• CVE-2015-3306 — ProFTPD improper access control via SITE CPFR / SITE CPTO (CVSS 10.0 per Security Affairs). Old FTP servers still linger on some SMB networks.
• CVE-2015-5477 — ISC BIND denial of service via TKEY queries.
• CVE-2016-3081 — Apache Struts command injection when Dynamic Method Invocation is enabled.
• CVE-2023-22894 — Strapi cleartext / query-filter exposure of sensitive user details; vendor guidance is to move to a supported release (see Strapi’s security disclosure). CISA notes it can be chained with CVE-2023-22621 for remote code execution.

All five share the October 11 federal due date. Four of the five, including ONLYOFFICE, carry the forensic-triage flag. You do not need to run every product on that list—but you do need a short inventory that says which ones you run, where they listen, and who patches them.

What CISA’s KEV listing means for a private business

The October 11 due date is binding on federal civilian agencies under CISA’s Binding Operational Directive framework (BOD 26-04 is the risk-based update agencies now follow). CISA continues to encourage all organizations to prioritize KEV catalog vulnerabilities. For a private NYC firm, treat the due date as a strong operational signal: if Document Server is still below 5.6.3, schedule the upgrade now, not after the next busy season.

Two KEV fields are worth repeating in staff briefings:

• Forensic triage required: Yes. Patching alone is not the whole job if the service was internet-facing during the exploitation window.
• Known ransomware campaign use: Unknown. Absence of a public ransomware tag is not a free pass; AA26-281A frames the observed activity around data theft and persistence, which is damaging enough on its own.

A practical checklist for NYC SMBs and their IT teams

Work through this list today. The upgrade itself should be done by whoever owns the Document Server host.

1. Inventory. Find every ONLYOFFICE Document Server instance: VMs, Docker hosts, Nextcloud integrations, and any appliance or shared hosting panel that embeds Docs. Record the exact version string.
2. Confirm JWT status and exposure. Note whether JWT is enabled and whether the service answers on a public IP, a reverse proxy, or only on an internal network. CISA’s description ties the vulnerable path to JWT being in use—so “we enabled JWT for security” is not a reason to skip the check.
3. Upgrade to 5.6.3 or later. Follow ONLYOFFICE’s supported upgrade path for your install method (package, Docker image tag, or vendor appliance). Retire end-of-life stacks that cannot be upgraded cleanly.
4. Look back before you move on. Review access logs for unusual upload activity, unexpected restarts, new local accounts, odd outbound connections, and unfamiliar SoftEther or VPN client installs—AA26-281A specifically calls out SoftEther-style persistence after initial access. If anything looks wrong, escalate to incident response rather than assuming the patch erased a foothold.
5. Sweep the rest of the October 8 list. Confirm you are not still running exposed ProFTPD with dangerous site commands enabled, aging BIND, Struts with Dynamic Method Invocation, or an unsupported Strapi admin panel.
6. Reduce the blast radius going forward. Keep Document Server off the public internet when possible, put it behind MFA-aware reverse proxies, restrict management ports, and pin image tags so “latest” does not quietly roll you onto an untested build—or leave you stuck on a forgotten one.
7. Assign an owner. Collaboration servers, like VPN appliances and email security gateways, need a named person who watches KEV and vendor advisories every week.

What we are not publishing

This post stays with published vendor and government facts. We are not providing exploitation steps, proof-of-concept details, or payload examples. The goal is to get Document Server onto a fixed build and to treat prior exposure as something worth reviewing. If ONLYOFFICE or CISA updates guidance, follow the newer guidance.

The real lesson: “internal” collaboration tools are edge devices now

Over the past few weeks we have covered KEV pressure on Fortinet FortiMail, Citrix NetScaler, and Zammad helpdesk. ONLYOFFICE belongs in the same conversation whenever it accepts connections from outside a tightly controlled network. Document editors hold the files your firm cannot afford to lose or leak. When CISA says a years-old upload flaw is being exploited in the wild—and a multi-country advisory ties that CVE to active intrusion sets—the right response is inventory, patch, and a short look back through the logs.

The firms that handle these weeks calmly are not the ones with the flashiest stack. They are the ones who know every internet-facing service they run, who patches it, and what “done” looks like when CISA adds another KEV entry on a Wednesday afternoon.

Talk to MicroSky

MicroSky Managed Services helps New York City businesses inventory collaboration platforms, keep Document Servers and other edge services patched, and turn a KEV alert into a controlled maintenance window instead of a scramble. If you want a second set of eyes on ONLYOFFICE, Nextcloud, or your broader patching process, call us at (718) 672-2177 or visit microskyms.com.

Sources: CISA Known Exploited Vulnerabilities catalog; CISA AA26-281A (October 8, 2026); NIST NVD, CVE-2021-3199; ONLYOFFICE DocumentServer 5.6.3 changelog; Security Affairs; East Bay Cyber KEV digest, October 8, 2026; Strapi security disclosure (batch context).