CVE-2015-3306: ProFTPD Improper Access Control Vulnerability

RBRecent Breaches Vulnerability Intelligence·Oct 8, 2026

CVSS 10.0 · Critical⚠ Actively exploited (CISA KEV)

10.0

CVSS score

Critical

Severity

Active

CISA KEV

Ransomware use

Oct 11, 2026

Patch deadline

⚠ Exploited in the wild. CISA added CVE-2015-3306 to its Known Exploited Vulnerabilities catalog on Oct 8, 2026, with a federal patch deadline of Oct 11, 2026 — meaning attackers are actively using it. If you run the affected software, patch it immediately.

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

Details

AffectedProFTPD · ProFTPD

WeaknessCWE-284

CVSS base score10.0 (Critical)

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

PublishedMay 18, 2015

Added to CISA KEVOct 8, 2026

Federal patch deadlineOct 11, 2026

Known ransomware useNot documented

Check if your data is exposed →

Frequently asked questions

Is CVE-2015-3306 being actively exploited?

Yes — CISA lists CVE-2015-3306 in its Known Exploited Vulnerabilities (KEV) catalog, so it is confirmed exploited in the wild. Patch it as a priority.

What does CVE-2015-3306 affect?

CVE-2015-3306 affects ProFTPD · ProFTPD.

How do I fix CVE-2015-3306?

Apply the vendor’s patch for the affected software. The federal patch deadline was Oct 11, 2026. Then check whether your personal data was exposed in any related breach.

References

Official records: NVD · CISA KEV

← All actively-exploited vulnerabilities