CISA Adds ProFTPD File Copy Vulnerability to KEV Catalog With Oct. 11 Deadline

The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2015-3306 to its Known Exploited Vulnerabilities (KEV) catalog on October 8, 2026, setting a federal compliance deadline of October 11, 2026, for mitigation or discontinuation of the affected product.

The vulnerability exists in ProFTPD, an open-source FTP server software. According to the National Vulnerability Database (NVD), the flaw resides in the mod_copy module of ProFTPD version 1.3.5. It is rated as Critical with a CVSS score of 10.0. The weakness, classified under CWE-284 (Improper Access Control), enables remote attackers to read and write to arbitrary files on the server. Attackers exploit this by using the site cpfr and site cpto commands, which are designed for copying files within the FTP service but lack proper access restrictions in the affected version.

Context and Background

CISA’s inclusion of CVE-2015-3306 in the KEV catalog signals that the agency has identified active exploitation of this vulnerability in the wild or deems the risk sufficiently high to warrant immediate federal action. The KEV catalog is a list of vulnerabilities that have been exploited in the wild and require prioritized remediation.

The NVD record specifies that the mod_copy module is the specific component responsible for the improper access control. By allowing unrestricted file operations through the site cpfr (copy from) and site cpto (copy to) commands, the vulnerability bypasses standard security controls. This allows an unauthenticated remote attacker to potentially exfiltrate sensitive data or write malicious files to the system, leading to full system compromise.

Who Is Affected

The primary stakeholders are organizations running ProFTPD version 1.3.5, particularly those with internet-exposed assets. CISA’s guidance emphasizes that stakeholders are responsible for evaluating each asset's internet exposure. The directive applies to all federal civil executive branch (FCEB) agencies, which must comply with CISA’s Binding Operational Directive (BOD) 26-04, "Prioritizing Security Updates Based on Risk."

Cloud service providers and other entities using ProFTPD must also adhere to the guidance. If mitigations are unavailable for specific cloud services, CISA requires the discontinuation of the product’s use. The agency notes that ransomware use of this specific vulnerability is currently unknown, but the critical severity and remote exploitability pose a significant threat to infrastructure integrity.

What should you do?

Federal agencies and other organizations must apply mitigations in accordance with vendor instructions by the October 11, 2026, due date. CISA directs stakeholders to follow BOD 26-04 guidance, which prioritizes security updates based on risk. Additionally, organizations should ensure adherence to CISA’s “Forensics Triage Requirements” to detect potential exploitation.

If vendor-provided patches or mitigations are not available, the required action is to discontinue use of the product. Organizations should immediately audit their environments for internet-exposed ProFTPD instances, specifically version 1.3.5, and verify that the mod_copy module is either patched, disabled, or that the service is removed from internet-facing networks.