CVE-2015-3306

ProFTPD — ProFTPD Improper Access Control Vulnerability

CISA KEV · in the CISA KEV catalog since 2026-10-08

ExigentCISA federal deadline · Overdue by 6 daysCISA KEVActively Exploited

What EVULNABLE says

Listed in the CISA KEV catalog, and an EPSS probability of 0.995.

CISA KEV: applied
Ransomware: did not apply
Vendor exploitation: did not apply
EPSS: applied
Microsoft Exploitability Index: did not apply
Pre-patch disclosure: did not apply
KEV recency: applied
CVSS: applied

Out-of-Band / Urgent Remediation

EVRS93/100

EVRS priorityImmediate

Evidence available

6 of 7 signals

CVSS: CVSS base score 10.0 (NVD)
EPSS: 99.5% EPSS probability
CISA KEV: Listed in the CISA KEV catalog
Pre-patch disclosure: Disclosure status unavailable
Vendor exploitation: Confirmed exploitation in the wild
Ransomware: No known ransomware campaign association
CISA KEV listing date: added to CISA KEV within the last 30 days

Why some signals show no data

CVSS: 10.0
EPSS: 0.995 (99.94th pctl)
CISA deadline: 2026-10-11 CISA federal deadline · Overdue by 6 days

NVD ↗CISA KEV ↗Vendor Advisory ↗

The priority band answers “how soon”, not “how bad” — see Methodology for what it weighs and where it abstains.

The evidence behind it

Measure	Value	Source	What it means
CVSS base score	10.0	NVD	How severe the flaw is in itself. It does not say how likely an attack is.
FIRST EPSS	0.995 (99.94th pctl)	FIRST	FIRST's estimate of the chance this is exploited in the next 30 days, and how that ranks against all CVEs.
Actively exploited	Confirmed	CISA KEV	Whether a source of record has confirmed attacks using it in the wild.
Ransomware campaign use	Unknown or none	CISA KEV	Whether CISA has seen ransomware operators use it.
CISA remediation deadline	2026-10-11 — CISA federal deadline · Overdue by 6 days	CISA KEV	The date US federal agencies must have fixed or mitigated it.
Public exploit module	Public module exists	Metasploit	Module existing is not the same as active exploitation.
EUVD cross-reference	Listed	ENISA EUVD	ENISA's own vulnerability database entry for this CVE, where one exists.

Impacted software or hardware

proftpd Software — 1.3.5
fedora Operating system — 20, 21, 22
debian linux Operating system — 7.0, 8.0, 9.0
tumbleweed Operating system
linux enterprise server Operating system — 15

Remediation: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Remediation basis: CISA KEV required action

ENISA EUVD also lists this CVE at CVSS 10.0 (v3.1), assigned by mitre. Source: euvd.enisa.europa.eu.

Metasploit lists a public excellent-rank module for this CVE: ProFTPD 1.3.5 Mod_Copy Command Execution (unix/ftp/proftpd_modcopy_exec) — module existing is not the same as active exploitation; see metasploit.com.

8 days recorded, 2026-10-08 to 2026-10-15

99.50% as of 2026-10-15 (99.94th percentile). FIRST EPSS, recorded daily since this page started tracking it.

2026-10-08 2026-10-15

What CISA says to do

The primary records

This page is an opinion about urgency. Where it and a source of record disagree, the source of record is the record.

NVD ↗ CISA KEV ↗ Vendor Advisory ↗

Where this sits

CVE-2015-3306 is one of the entries ranked on the priority feed and in the non-Microsoft advisories.