On October 8, 2026, CISA added CVE-2015-3306 to the Known Exploited Vulnerabilities catalog with a federal remediation due date of October 11, 2026. The vulnerability is in ProFTPD when mod_copy is enabled: unauthenticated SITE CPFR / SITE CPTO commands could copy arbitrary files on the server. Public references call out ProFTPD 1.3.5 and 1.3.4e; upstream fixed the issue by requiring authentication for those commands (commonly cited via the ProFTPD pull request that landed in packages such as Debian's 1.3.5-2 and later). FTP feels like 2012 infrastructure. It is still how some B2B SaaS ingest partner EDI, agency creative drops, and "temporary" migration shares that became permanent. If that listener is ProFTPD with mod_copy, today is patch day — not a backlog ticket.
Why this CVE still matters in 2026
Unauthenticated arbitrary file read/write on a file-transfer host is a full compromise path: steal secrets from the FTP user's home, plant webshells on shared storage, or read cloud credential files mistakenly left on the box. KEV listing means exploit code and scanning are in the wild again as part of the early-October aged-CVE wave. Do not limit inventory to "the production FTP." Check AMI golden images, customer VPC appliances you still support, and jump hosts that run ProFTPD for "ops convenience."
Remediation sequence
1. Find listeners. Internal CMDB, ss -lntp on bastions, security group rules allowing 21/tcp from the internet, and container images with proftpd packages. 2. Version and modules. Confirm ProFTPD version and whether mod_copy is loaded. Vulnerable 1.3.5 / 1.3.4e with mod_copy are the urgent set. 3. Patch or mitigate. Upgrade to a distribution package that includes the authentication requirement for CPFR/CPTO, or apply the upstream fix. Interim: disable mod_copy; deny SITE commands at the config layer; restrict source IPs. 4. Forensics posture. CISA's KEV context for related aged CVEs often implies triage before casual reimaging. Snapshot disks, preserve auth logs, and look for unexpected file copies around the FTP chroot. 5. Product migration. Give partners a deadline to move to SFTP with key auth or HTTPS multipart upload. Every week FTP stays internet-exposed is a week you argue with auditors about 2015 CVEs.
ProFTPD KEV checklist (CVE-2015-3306 / due 2026-10-11)
[ ] Inventory hosts/images with ProFTPD; note version + mod_copy
[ ] Block 21/tcp from 0.0.0.0/0 unless explicitly required
[ ] Upgrade past vulnerable builds OR disable mod_copy now
[ ] Review FTP logs for SITE CPFR/CPTO from unknown clients
[ ] Rotate credentials that lived on the FTP filesystem
[ ] Publish partner cutover plan to SFTP / signed HTTPS uploadFounder takeaway
CVE-2015-3306 is an unauthenticated ProFTPD mod_copy file read/write now on CISA KEV with an October 11, 2026 due date. Patch or disable mod_copy today, hunt for abuse, and treat lingering public FTP as a product debt with a kill date. DevOps teams that only harden Kubernetes while leaving FTP golden images alone are securing the wrong layer.
Partner communication that prevents ticket storms
When you disable FTP or break CPFR-based workflows, partners notice. Send a dated notice: CVE identifier, why the listener changes, the SFTP or HTTPS replacement, and a cutover week. Offer a parallel run if you must, but cap it. Indefinite dual-run is how vulnerable listeners stay "temporary" for years. For agencies exchanging large creative assets, signed cloud storage uploads with short-lived URLs usually outperform FTP on both security and speed. Budget the IAM work once; stop maintaining chroots.
Container note: some "sftp" images still bundle ProFTPD under the hood. Read the Dockerfile. If the base package is vulnerable 1.3.5 with mod_copy, your Kubernetes service is in scope even if the service name says otherwise.
Hardening after the emergency patch
Require key-based SFTP, disable password auth, chroot aggressively, and ship logs to your SIEM with alerts on SITE commands. Remove world-readable home directories. If the FTP host shared a filesystem with web content, assume read access may have exposed application secrets — rotate.
Add ProFTPD (and vsftpd equivalents) to the golden-image ban list unless a documented exception exists. Prevention beats another KEV weekend.
What to do in the next two weeks
Put an owner on the checklist in this article, schedule the verification work, and write down what "done" means in your ticketing system. Share the primary-source links with security and counsel so debates start from the vendor or regulator text, not from a slide paraphrase. If you need external help, bring them the inventory — versions, hosts, and current configs — not a blank calendar invite.
Close the loop with a short internal note: what changed, what remains open, and which customer communications went out. That note becomes the seed of your next audit response and keeps the organization from relearning the same lesson next KEV wave.
Cloud and hybrid gotchas
Lift-and-shift migrations often bring FTP AMIs into a new VPC "temporarily." Check peering routes and public IPs after every network change. Object-storage gateways that speak FTP in front of S3 are still FTP listeners for exploit purposes if they embed vulnerable ProFTPD. Prefer native HTTPS multipart or S3 signed URLs. If a legacy mainframe partner only speaks FTP, isolate that listener on a dedicated host with no cloud metadata access and monitor it like a honeypot that happens to be required. Red-team or external ASM reports that still list port 21 deserve same-week tickets after a KEV listing — not a quarterly backlog label.
Evidence for auditors
Keep package changelogs, the config diff that disabled mod_copy, and firewall rule screenshots. If you rebuilt the host, note the snapshot id retained for forensics. Auditors ask for proof of KEV response speed; your October 11 work should be reconstructible six months later.
