ProFTPD Access Control Flaw: Federal Agencies Must Patch by Oct 11 After CISA KEV Addition
Federal agencies must remediate a critical ProFTPD access control flaw by October 11 after CISA added it to the KEV catalog.
Key points
- CISA added CVE-2015-3306 to the Known Exploited Vulnerabilities catalog on Oct. 8, 2026.
- The flaw allows remote attackers to read and write arbitrary files via FTP commands.
- Federal agencies have a compliance deadline of Oct. 11, 2026, to apply mitigations.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a strict remediation deadline for a critical vulnerability in ProFTPD, a widely used FTP server software. The agency added CVE-2015-3306 to its Known Exploited Vulnerabilities (KEV) catalog on October 8, 2026, requiring federal agencies to mitigate the issue by October 11, 2026.
How it unfolded
- CISA identified the improper access control flaw in ProFTPD as actively exploited.
- The agency cited reports from The Hacker News linking the abuse to Flax Typhoon, a China-linked threat actor.
- On October 8, 2026, CISA formally added CVE-2015-3306 to the KEV catalog with a three-day compliance window.
Who is affected
The vulnerability impacts ProFTPD version 1.3.5 and earlier configurations that enable the mod_copy module. According to the National Vulnerability Database, the flaw carries a CVSS score of 10.0, rated Critical. It allows remote attackers to bypass access controls and read or write to arbitrary files on the server using the site cpfr and site cpto commands. This capability can lead to unauthorized data exfiltration or the deployment of malicious code. Managed service providers and IT teams managing legacy FTP infrastructure are at significant risk, particularly if servers are exposed to the internet.
The fix
CISA requires stakeholders to apply mitigations in accordance with vendor instructions. The directive references CISA’s Binding Operational Directive (BOD) 26-04 on prioritizing security updates based on risk. If specific mitigations are unavailable for cloud services or specific deployments, CISA advises discontinuing the use of the product. Organizations must evaluate each asset’s internet exposure and ensure adherence to BOD 26-04 patching guidelines. No specific patch version is detailed in the KEV entry, but compliance with vendor guidance is mandatory for federal entities.
What to do and how to stay safe: ProFTPD
- Inventory all systems running ProFTPD to identify instances using version 1.3.5 or older.
- Disable the mod_copy module if it is not required for business operations to reduce the attack surface.
- Monitor FTP logs for unusual usage of the site cpfr and site cpto commands, which may indicate exploitation attempts.
- Apply vendor-provided updates or configuration changes immediately to address the improper access control flaw.
Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the deadline for federal agencies to fix this ProFTPD flaw?
Federal agencies must mitigate CVE-2015-3306 by October 11, 2026, per CISA’s KEV catalog entry.
Which threat actor is linked to exploiting this vulnerability?
The Hacker News reports that Flax Typhoon, a China-linked threat actor, has exploited this flaw.
What commands do attackers use to exploit CVE-2015-3306?
Attackers use the site cpfr and site cpto commands to read and write arbitrary files.
