CISA flags four-year-old ONLYOFFICE bug as actively exploited — but won't say how

The headline fact

CISA, the US government’s cybersecurity agency, has added CVE-2021-3199 — a vulnerability in ONLYOFFICE Docs, the open-source office suite used as a self-hosted alternative to Google Docs or Microsoft 365 — to its Known Exploited Vulnerabilities catalogue. The entry went live on 8 October 2026, and US federal civilian agencies have been given until 11 October to patch or mitigate it. That’s a three-day window, which is CISA’s shorthand for “this is already being used against real targets, not just theorised in a lab.”

Being on the KEV list means exactly that: confirmed exploitation, not a hypothetical risk. CISA doesn’t add things speculatively.

What the bug actually does

Here’s the catch for anyone wanting specifics: CISA’s own listing doesn’t describe the mechanics of the flaw, who’s behind the attacks, or how widely it’s being used. The agency’s standard advice is simply to follow ONLYOFFICE’s own patching instructions and align with its broader BOD 26-04 directive on prioritising security updates by risk. Whether this is being used by ransomware crews is explicitly logged as “Unknown” in CISA’s own data — not confirmed one way or the other.

For the technical detail — what kind of flaw this is, its severity score, and how old the fix is — the relevant record sits on NVD’s page for CVE-2021-3199. The vulnerability itself was first catalogued back in 2021, meaning this isn’t a brand-new zero-day: it’s an older, known issue that attackers have apparently only just started exploiting in the wild in meaningful numbers, or that CISA has only now confirmed evidence for.

So who is actually at risk

This is squarely an enterprise and self-hosted-software story, not a consumer one. ONLYOFFICE Docs is typically deployed by organisations running their own document collaboration server — businesses, public sector bodies, universities — rather than something an average person installs at home. If you’ve never heard of ONLYOFFICE, you almost certainly aren’t running it.

The mandatory three-day patch deadline applies only to US federal civilian executive branch agencies, not to the UK, private businesses, or individuals. That said, KEV listings function as a widely watched early-warning signal: when CISA confirms active exploitation of a product, security teams everywhere — including in the UK — tend to treat it as a prompt to check their own exposure, since attackers rarely confine themselves to one country’s government networks.

What to do about it

If your organisation runs a self-hosted ONLYOFFICE Docs server, the sensible move is to check which version you’re on and apply whatever fix the vendor has published for this CVE, rather than wait and see. IT and security teams should treat the KEV listing as confirmation that scanning or exploitation attempts are happening now, somewhere, even if CISA hasn’t published the specifics.

Everyone else — anyone not running ONLYOFFICE’s server software themselves — has nothing to do here. This isn’t a bug in a document file, a browser plugin, or anything that reaches ordinary users’ devices.

The takeaway

What’s solid: CISA has confirmed real-world exploitation of a known ONLYOFFICE Docs flaw and set a hard deadline for US federal systems. What’s thin: the public record says almost nothing about the attackers, the attack method, or the scale. If you’re not an organisation self-hosting this software, this is one to note and move on from — not one to