Key points
- CISA added CVE-2015-3306 to the Known Exploited Vulnerabilities catalog on October 8, 2026.
- Federal agencies must apply mitigations or discontinue use by October 11, 2026.
- The flaw allows remote attackers to read and write arbitrary files via specific FTP commands.
Federal agencies have a narrow window to secure their ProFTPD servers. The Cybersecurity and Infrastructure Security Agency (CISA) mandated that federal entities address a critical access control vulnerability in the ProFTPD file transfer software by October 11, 2026. This addition to the Known Exploited Vulnerabilities (KEV) catalog signals immediate risk, requiring organizations to act in accordance with federal binding operational directive BOD 26-04.
In plain English
ProFTPD is a popular software used to transfer files between computers. A long-standing flaw in version 1.3.5 allows attackers to bypass security controls. Specifically, the `mod_copy` module permits remote users to execute commands that copy files from any location on the server to another location. This means an attacker can read sensitive data or write malicious files to arbitrary locations on the system without proper authorization.
The background
The vulnerability, tracked as CVE-2015-3306, has been known for years but remains a target. According to The Hacker News, the China-linked threat actor known as Flax Typhoon has exploited this specific flaw. CISA’s decision to add it to the KEV catalog reflects active exploitation in the wild. The National Vulnerability Database rates the issue as critical with a CVSS score of 10.0, citing improper access control weaknesses (CWE-284).
What changes now
For federal agencies, the October 11 deadline is a hard requirement. Stakeholders must evaluate the internet exposure of each asset running ProFTPD. If vendor-provided mitigations are unavailable or insufficient, agencies must discontinue the use of the product. Compliance requires following CISA’s guidance on prioritizing security updates and forensics triage. Non-federal organizations should note that while not legally bound by the federal deadline, the confirmed exploitation by a state-sponsored group indicates high risk for any internet-facing ProFTPD instance.
What to do and how to stay safe: ProFTPD
- Audit your network for any servers running ProFTPD version 1.3.5 or earlier.
- Disable the `mod_copy` module if the software must remain in use and immediate patching is not possible.
- Restrict internet access to FTP services using firewalls to limit exposure to untrusted networks.
- Monitor logs for unusual file copy activities or unauthorized command executions until once the vendor provides an update.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2015-3306?
It is a critical improper access control vulnerability in ProFTPD 1.3.5 that allows remote attackers to read and write arbitrary files.
Why is CISA adding an old vulnerability to the KEV catalog?
CISA adds vulnerabilities to the KEV catalog when there is evidence of active exploitation in the wild, such as by the Flax Typhoon threat actor.
What must federal agencies do by October 11?
They must apply mitigations per vendor instructions, follow BOD 26-04 guidance, or discontinue use of the vulnerable product if mitigations are unavailable.
