CISA Adds CVE-2021-3199 in ONLYOFFICE Docs to Actively Exploited Vulnerabilities
CISA lists CVE-2021-3199 in ONLYOFFICE Docs as actively exploited. Administrators should update Document Server to at least version 5.6.3.
CVE-2021-3199 ONLYOFFICE was added by CISA on October 8, 2026, to the Known Exploited Vulnerabilities (KEV) catalog, meaning it is listed among vulnerabilities being exploited in the wild. The flaw affects ONLYOFFICE Document Server versions earlier than 5.6.3.
This is an older path traversal flaw. When JWT is used, it can lead to remote code execution through an image-upload parameter. Unpatched servers, especially those accessible from the internet, may therefore be at risk of system takeover.
CVE-2021-3199 ONLYOFFICE: Fix Available Since Version 5.6.3
The vendor fixed the flaw in ONLYOFFICE Document Server version 5.6.3. CISA and the HKCERT security bulletin recommend upgrading to at least this version or a newer one.
CISA set October 11, 2026, as the remediation deadline for U.S. federal civilian agencies. The remediation deadline applies to these U.S. institutions, but inclusion in KEV is also relevant to other administrators because this involves confirmed exploitation, not merely a theoretical scenario.
What Administrators Should Check
Organizations using ONLYOFFICE Docs should identify Document Server installations older than 5.6.3 and update them as soon as possible. Particular attention is required for publicly accessible deployments and environments where JWT is enabled.
- verify the version of ONLYOFFICE Document Server in use,
- update vulnerable instances to at least version 5.6.3,
- check servers for signs of possible compromise,
- monitor for any new indicators of compromise and mitigations from CISA, ONLYOFFICE, or security teams.
Details of the Attacks Are Still Unavailable
CISA and other verified sources have not yet published technical details of the current exploitation. The identity of the attackers, the number of victims, the extent of the compromises, and whether the attacks target specific public-facing instances or are part of a broader campaign are unknown.
A possible statement from ONLYOFFICE about the documented exploitation, as well as the publication of additional technical information or indicators of compromise, may be expected.
Sources
- CISA Known Exploited Vulnerabilities Catalog – Confirms the addition of CVE-2021-3199 to KEV on October 8, 2026, documented exploitation, and the remediation deadline.
- ONLYOFFICE DocumentServer CHANGELOG – The vendor’s source for version 5.6.3, which fixes the affected flaw.
- NIST National Vulnerability Database – Confirms the flaw description, the JWT-use condition, the possibility of remote code execution, and affected versions earlier than 5.6.3.
- HKCERT Security Bulletin – Independently confirms the current exploitation alert and recommendation to update to version 5.6.3 or later.
Verified and updated: 10/09/2026 06:24
