CVE-2015-3306

Exploited in the wild. In CISA KEV since 2026‑10‑08. A vendor fix is available.

CVSS 3.110.0Critical EPSS percentile99th99% chance in 30 days CISA KEVListedsince 2026-10-08, due 2026-10-11
Public exploit: 9 sources FixVendor fixNo build named by the sources

Published 2015-05-18Updated 2026-10-09Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

The ProFTPD Project ProFTPDAffected: 1.3.5Upgrade to: not statedStated by: BDU

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check which version of ProFTPD your file server runs — if it's 1.3.5, you are affected.
If you don't manage the server yourself, forward this to whoever hosts or administers your FTP server today.
Upgrade ProFTPD to a version newer than 1.3.5 where mod_copy is fixed.
If you cannot upgrade immediately, disable the mod_copy module as a temporary measure.
Confirm the server isn't reachable from the open internet unless it absolutely needs to be.

Some work to apply

Check it yourselfA free Nuclei and OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

Coverage timeline

2 publishers

Advisory coverage
as reported · Oct 9, 2026·The Hacker News summary
Added to CISA KEV catalog
Oct 8, 2026·CISA KEV

Sourced from public security reporting — each date is when it was published, not when it happened. 1 further article named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

In plain language

Written by AI from the record

If you run a ProFTPD file server version 1.3.5, attackers can remotely read or write any file on it with no password needed, and this is actively being used in real attacks right now — you should act immediately.

ProFTPD 1.3.5's mod_copy module fails to enforce access controls on the "site cpfr" and "site cpto" FTP commands, allowing unauthenticated remote attackers to copy arbitrary files to and from the filesystem; the flaw is actively exploited, confirmed in CISA KEV, and has a public Metasploit module.

If you're affected

Full server takeover
Arbitrary file read/write
Customer data exposure
Website or backdoor planting
Operational disruption

What is it

ProFTPD is software many businesses use to run a file transfer server. This bug is like a building where a side door is supposed to require a key, but it actually lets anyone walk in and move files in or out of any room — including ones they shouldn't have access to — without ever showing ID.

Who is affected

This matters to you if you run a ProFTPD file server, specifically version 1.3.5. No login or user interaction is needed for an attacker to exploit it, so any internet-exposed ProFTPD 1.3.5 server is directly at risk.

How urgent is it

Attackers are already exploiting this vulnerability in the wild, it's listed in CISA's Known Exploited Vulnerabilities catalog, and a ready-made attack tool (Metasploit module) is publicly available — this is as urgent as it gets. CISA has set a remediation deadline of 2026-10-11. Treat any exposed ProFTPD 1.3.5 server as compromised until patched or taken offline.

What to do — in detail

Inventory all ProFTPD instances and confirm which are running version 1.3.5; check both internet-facing and internal servers since lateral movement is possible.
Upgrade to a ProFTPD release where mod_copy enforces proper access control checks on the site cpfr/cpto commands (any version past 1.3.5 with the fix applied).
If immediate upgrade isn't possible, disable or remove the mod_copy module from the server configuration as a stopgap, then restart the service.
Review server and FTP logs for suspicious 'SITE CPFR'/'SITE CPTO' commands, unexpected file reads/writes, or new/unfamiliar files (e.g., webshells) as this flaw has been used for forensic triage per CISA guidance.
CISA's remediation due date is 2026-10-11 — treat this as the hard deadline for patching or removing exposure; if mitigation isn't feasible, consider discontinuing internet exposure of the service per CISA BOD 26-04 guidance.
After patching, monitor for continued exploitation attempts and verify no backdoors were planted during the exposure window.

Technical context

CVSS 3.1 score 10.0 (Critical), vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — network-exploitable, low complexity, no privileges or user interaction required, scope change, full compromise of confidentiality, integrity and availability. Weakness class is CWE-284 (Improper Access Control): mod_copy does not validate permissions before executing SITE CPFR/SITE CPTO file copy operations. Confirmed in CISA KEV (added 2026-10-08, due 2026-10-11) with active in-the-wild exploitation; a Metasploit module exists along with 9 known public exploits, indicating high exploit maturity. Press attention is rising. Given confirmed exploitation, predictive likelihood scoring is superseded by this real-world evidence.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

Public exploit

CISA KEV

Listed as exploited in the wild since 2026-10-08.

US federal agencies must remediate by 2026-10-11.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Public exploits

9 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

99% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Sustained, driven by in-the-wild reports.

Lifecycle

A public exploit existed 61 days before the patch.

2026-10-09Patch availablepatch available, patch available, record updated, record updated, record updated
2026-10-08Added to CISA KEVpatch available, record updated
2026-06-25OpenVAS check added
2026-05-06Patch availablerecord updated
2026-03-06Metasploit modulesource: metasploitpublic exploit / poc, nuclei check added
2015-05-18Publishedweakness classified

Affected products

The ProFTPD Projectoss-project
- ProFTPDOn-premOSS Libraries
fedoraprojectoss-project · USaka fedora project
- fedoraOSOn-premOperating Systems / linux-distro
debianoss-project · GBaka debian gnu/linux
- debian linuxOSOn-premOperating Systems / linux-distro
opensuseoss-project · DE
- tumbleweedOn-premOperating Systems / linux-distro
susecommercial · DE
- linux enterprise serverOSOn-premOperating Systems / linux-distro
proftpdoss-projectaka proftpd-dfsg
- proftpdOn-premNetworking Infrastructure / network-management

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Scored 10.0 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable