Key points
- CISA added CVE-2021-3199 to the Known Exploited Vulnerabilities catalog on 8 October 2026.
- The flaw allows remote code execution via path traversal in image uploads when JWT is enabled.
- Federal systems must apply mitigations by 11 October 2026 or discontinue use if patches are unavailable.
The short version
- ONLYOFFICE Docs Server versions prior to 5.6.3 contain a critical path traversal vulnerability.
- Attackers can achieve remote code execution by exploiting image upload parameters.
- CISA has set a strict federal due date for remediation or removal of the affected software.
The details
The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2021-3199 to its Known Exploited Vulnerabilities (KEV) catalog. The entry was published on 8 October 2026, with a federal compliance deadline of 11 October 2026. This addition signals that the vulnerability is being actively exploited in the wild, necessitating immediate attention from security teams.
The vulnerability resides in the ONLYOFFICE Document Server, specifically in versions earlier than 5.6.3. According to the National Vulnerability Database (NVD), the flaw is rated as Critical with a CVSS score of 9.8. It is classified under CWE-22, indicating a directory traversal issue.
The technical mechanism involves a path traversal attack within the `/upload` endpoint. When JSON Web Tokens (JWT) are used for authentication, an attacker can inject a `/..` sequence into an image upload parameter. This manipulation allows the attacker to traverse directories outside the intended scope, ultimately leading to remote code execution on the server. The NVD description confirms that this exploitation vector is specific to environments where JWT is utilised.
The context
CISA’s inclusion of CVE-2021-3199 in the KEV catalog carries significant regulatory weight for US federal agencies. Under Binding Operational Directive (BOD) 26-04, agencies are required to prioritise security updates based on risk. For this specific vulnerability, the directive mandates that stakeholders apply mitigations in accordance with vendor instructions.
If vendor-provided mitigations are unavailable, federal agencies must discontinue the use of the affected product. This requirement applies to both on-premise installations and cloud services. Agencies are responsible for evaluating the internet exposure of each asset and ensuring strict adherence to patching guidelines. The directive also references CISA’s “Forensics Triage Requirements,” implying that incident response teams should be prepared to investigate potential compromises.
The ransomware usage status for this vulnerability is currently listed as Unknown by CISA. However, the potential for remote code execution makes it a high-value target for threat actors seeking initial access to internal networks.
Defender's checklist
- Identify all instances of ONLYOFFICE Document Server running versions prior to 5.6.3.
- Verify if JWT authentication is enabled on these instances, as this is a prerequisite for exploitation.
- Apply vendor-provided patches or mitigations immediately.
- If no fix is available, discontinue use of the product to comply with BOD 26-04.
- Review logs for suspicious activity involving the `/upload` endpoint and `/..` sequences.
- Ensure cloud service configurations align with federal patching guidelines.
Background: Remote code execution vulnerabilities
Remote code execution vulnerabilities let attackers run arbitrary commands on a target system remotely. They exploit flaws in how software processes untrusted input. Prevention requires strict input validation, least privilege access, and regular patching. These flaws remain dangerous because they grant immediate control over the affected machine.
Read the full guide: Remote Code Execution Vulnerabilities: How They Work and How to Stop Them
What to do and how to stay safe: ONLYOFFICE
- Patches repair specific code flaws that attackers can predict and exploit.
- Automatic software updates reduce the window of exposure to known threats.
- An IT asset inventory ensures you do not overlook forgotten or legacy systems.
Unpatched software leaves known entry points open for automated attacks. Enable automatic updates and maintain an inventory of all your devices.
Step-by-step guide: Unpatched Software: Why Missing Updates Create Hidden Entry Points
General security guidance from the Cipher Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2021-3199?
CVE-2021-3199 is a critical path traversal vulnerability in ONLYOFFICE Docs Server that allows remote code execution via image upload parameters when JWT is used.
Which versions of ONLYOFFICE are affected?
Versions of ONLYOFFICE Document Server prior to 5.6.3 are affected by this vulnerability.
What is the deadline for federal agencies to address this?
Federal agencies must apply mitigations or discontinue use by 11 October 2026.
