Is CVE-2015-3306 (ProFTPD Improper Access Control) being exploited in the wild?

Yes. CISA added CVE-2015-3306 to its Known Exploited Vulnerabilities catalogue on 8 October 2026, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

How to read a KEV listing for this CVE

CISA’s KEV catalogue is the most practical signal here: if a flaw is listed, defenders should treat it as actively exploited until proven otherwise. For CVE-2015-3306, that means exposure assessment should start with whether any ProFTPD service is still reachable, whether it is internet-facing, and whether the affected command paths are present in production or legacy environments.

Because the issue is an improper access control weakness, the key question is not just whether ProFTPD is installed, but whether any reachable instance can be driven through the file transfer commands that enable arbitrary read and write behaviour. A service that is “rarely used” but still live can still be the easiest entry point in the estate.

What the exploitation path means operationally

This vulnerability matters because access control failure in an FTP service can become direct file-system manipulation, not merely an application error. If an attacker can read or write arbitrary files, the practical consequences include web shell placement, credential theft from exposed configuration files, service tampering, and staging for later lateral movement.

When a KEV entry exists for a file-transfer service flaw, assume the attacker objective is usually fast foothold creation or destructive modification, not long reconnaissance. That changes the defender’s priority from “is there a patch?” to “what reachable systems could already have been touched, and what would write access let an attacker change next?”

What to do if you cannot patch immediately

The first mitigation priority is to remove exposure, not to wait for a perfect maintenance window. If the affected ProFTPD instance must remain online briefly, restrict network reachability, disable unnecessary service exposure, and look for any compensating control that prevents unauthenticated or low-trust access from reaching the vulnerable path.

Where the service has been exposed externally, Zero-Day and Exploited Vulnerabilities Guide is the right operational pattern: confirm reachability, apply the vendor fix or mitigation as soon as possible, and then verify whether there are signs of abuse before returning the service to normal trust.

If patching is delayed, treat any adjacent files, credentials, or content repositories as potentially exposed. For a write-capable flaw, the concern is not only data disclosure but silent persistence through modified configuration, uploaded payloads, or tampered automation artifacts.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Active exploitation requires rapid exposure review and remediation prioritisation.
Recommendation — Prioritise and remediate the exposed ProFTPD instance before routine patch queues.
MITRE ATT&CK	T1190 — Exploit Public-Facing Application	An internet-reachable ProFTPD service can be abused as the initial access path.
Recommendation — Hunt for public-facing exploitation attempts against the FTP service and adjacent assets.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	KEV-listed exploitation makes timely flaw remediation central to this CVE response.
	AU-6 — Audit Record Review, Analysis, and Reporting	Post-exposure review depends on reviewing logs for suspicious command and file activity.
Recommendation — Accelerate remediation of the vulnerable ProFTPD deployment and document exceptions. Review ProFTPD and host logs for suspicious file-transfer and modification activity.
OWASP ASVS	V8 — Authorization	The flaw is an access-control failure that bypasses expected file-operation restrictions.
Recommendation — Validate server-side authorization checks around file read and write operations.

Practitioner Guidance

What to verify: Confirm whether any ProFTPD instance is still in service, whether it is internet-facing, and whether logs show suspicious use of the site cpfr and site cpto commands or unusual file changes around the exposure window.

Escalation / exception: If the service handled secrets, admin uploads, or web content, escalate quickly to compromise assessment rather than treating the issue as a routine patch ticket. In that case, the integrity question is as important as the patch question.

Practitioner takeaway: For an actively exploited file-transfer vulnerability, the operational order is exposure first, compromise check second, and patch third only if the system is still safe enough to keep running.