ProFTPD Improper Access Control — exploitable from the network with no login

What it is

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

Why it matters

• CISA added it to the Known Exploited Vulnerabilities catalogue on October 8, 2026 — observed exploitation, on the record.
• EPSS puts the chance of exploitation in the next 30 days at 98.0% — the top 0.1% of all scored CVEs.
• CVSS 10.0 (critical), and it is reachable over the network, needs no credentials, needs no user interaction.

What to do

• Patch it. CISA's due date for federal agencies is October 11, 2026, which is as good a deadline as any for everyone else.
• Check CISA's advisory for affected versions: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3306

---

Drafted from CVE-2015-3306 — CISA KEV, NVD, FIRST EPSS. Check before publishing.