ONLYOFFICE Docs
Web-based open-source office suite with collaborative document, spreadsheet and presentation editors.
CISA put ONLYOFFICE Docs flaw CVE-2021-3199 on its exploited list on 8 October 2026 and gave federal agencies three days to fix it, after ten allied agencies tied it to hackers linked to Beijing's Integrity Technology Group.
Last refreshed: 12 October 2026
Why did a 2021 ONLYOFFICE flaw get a three-day deadline in 2026?
Timeline for ONLYOFFICE Docs
Named as ONLYOFFICE Docs
Cybersecurity: Threats and Defences: Mentioned in: Ten agencies name Beijing firm in hacksBackground
ONLYOFFICE Docs is a web-based, open-source office suite whose editors handle documents, spreadsheets and presentations. A commercial edition is sold as ONLYOFFICE Docs Enterprise, and the editing engine runs as a component called Document Server.
Its best-known security flaw, CVE-2021-3199, is a PATH traversal in Document Server's /upload function in versions before 5.6.3. When JWT authentication is in use the bug can be reached, and it can lead to Remote Code Execution. A fix shipped in early 2021.
Five years on, the flaw entered CISA's exploited catalogue on 8 October 2026 with an 11 October Deadline for US federal agencies, after allied advisory AA26-281A named it among the bugs used by actors tied to Integrity Technology Group. The listing therefore targets installations left unpatched since 2021, not a new weakness in current releases.
A five-year-old fix became urgent
Joint advisory AA26-281A, published on 8 October 2026 by ten agencies from seven countries, listed the ONLYOFFICE Document Server bug among those exploited by actors working with Integrity Technology Group. CISA added it to the Known Exploited Vulnerabilities catalogue that day with an 11 October Deadline, alongside four other old flaws it had not held before.
ONLYOFFICE had closed the hole in version 5.6.3 in early 2021, so the Deadline landed on servers that had gone more than five years without that upgrade. For anyone running a self-hosted Document Server, the task in October was a version check against 5.6.3 rather than waiting on a fresh fix.