Executive Summary
On October 8, 2026, CISA added CVE-2015-3306 to the Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation in the wild. This vulnerability affects ProFTPD 1.3.5 and earlier versions when the `mod_copy` module is enabled. Despite its age, the flaw remains a high-value target for botnet operators and initial access brokers seeking to compromise internet-exposed infrastructure.
The vulnerability stems from the `SITE CPFR` and `SITE CPTO` command handlers, which fail to enforce authentication or authorization. Attackers use these commands to copy sensitive files (e.g., `/etc/passwd`) or upload and relocate executable payloads into web-accessible directories to achieve remote code execution (RCE). Organizations must urgently inventory ProFTPD installations, particularly on legacy appliances or NAS devices, and apply patches or disable the affected module.
Impacted organizations, especially federal agencies under BOD 26-04, should prioritize remediation and assume compromise if vulnerable instances were found exposed to the internet. Remediation includes upgrading to ProFTPD 1.3.5a/1.3.6rc1 or later, or disabling `mod_copy` entirely.