Remediate ProFTPD CVE-2015-3306 by Oct 11 to Block CISA-Listed Remote File Access Exploit
Federal agencies must mitigate CVE-2015-3306 in ProFTPD by October 11 to prevent unauthorized file access exploited by threat actors.
Key points
- CISA added CVE-2015-3306 to the Known Exploited Vulnerabilities catalog on October 8, 2026.
- The flaw allows remote attackers to read and write arbitrary files using specific FTP commands.
- Federal entities have until October 11, 2026, to apply mitigations or discontinue use.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has mandated that federal agencies mitigate a critical access control flaw in ProFTPD by October 11, 2026. Added to the Known Exploited Vulnerabilities (KEV) catalog on October 8, this directive targets CVE-2015-3306, a vulnerability that enables unauthorized file manipulation.
This addition follows confirmed abuse by Flax Typhoon, a threat group linked to China, according to The Hacker News. The adversary has leveraged this specific flaw to gain unauthorized access to systems. CISA’s inclusion of the vulnerability in the KEV catalog signals active exploitation in the wild, triggering strict compliance requirements under Binding Operational Directive 26-04. Federal stakeholders must evaluate their internet-exposed assets and ensure adherence to these patching guidelines immediately.
Technical Mechanics of the Vulnerability
CVE-2015-3306 resides within the mod_copy module of ProFTPD version 1.3.5. The National Vulnerability Database rates the issue as critical with a CVSS score of 10.0. The weakness stems from improper access controls, categorized under CWE-284.
Remote attackers can exploit this flaw by issuing the `site cpfr` and `site cpto` commands. These commands allow the attacker to read from and write to arbitrary files on the server. This capability bypasses standard permission checks, granting the attacker broad control over the file system. The ability to copy files from any location to any other location facilitates data exfiltration or the deployment of malicious code.
Impact on Federal and Small Business Infrastructure
While the immediate deadline applies to federal agencies, the technical risk extends to any organization running affected versions of ProFTPD. The KEV catalog entry specifies that stakeholders are responsible for evaluating each asset’s internet exposure.
If mitigations are unavailable or cannot be applied, CISA instructs organizations to discontinue use of the product. This is particularly relevant for cloud services or legacy systems where updating may be complex. The requirement aligns with CISA’s guidance on prioritizing security updates based on risk. Small-business owners using ProFTPD for file transfers must verify their server versions and access controls, even if they are not subject to federal BOD 26-04 mandates.
What to watch
Organizations should monitor for unusual file activity or large data transfers originating from FTP servers. Security teams must review logs for instances of the `site cpfr` and `site cpto` commands, which are not standard FTP operations and may indicate exploitation attempts. As the October 11 deadline approaches, federal agencies will report compliance status, but private sector entities should treat the KEV addition as a signal of active targeting.
What to do and how to stay safe: ProFTPD
- Verify if your organization uses ProFTPD version 1.3.5 or earlier, and check if the mod_copy module is enabled.
- Review FTP server logs for occurrences of the site cpfr and site cpto commands, which indicate potential exploitation.
- Restrict network access to FTP servers to trusted IP addresses only, reducing the attack surface for remote attackers.
- Once the vendor provides an update, apply it immediately; if no update is available, consider disabling the mod_copy module or removing the service from internet-facing networks.
Step-by-step guide: How Security Advisories Drive Patch Decisions and Reduce Risk
General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2015-3306?
It is an improper access control vulnerability in ProFTPD 1.3.5 that allows remote attackers to read and write arbitrary files via the site cpfr and site cpto commands.
When is the federal deadline for mitigation?
Federal agencies must apply mitigations or discontinue use by October 11, 2026, according to CISA guidelines.
Who is exploiting this vulnerability?
The threat actor known as Flax Typhoon, which is linked to China, has been observed exploiting this flaw, according to The Hacker News.
