A decade-old ProFTPD bug just landed on the US 'actively exploited' list — here's what that does and doesn't mean
CISA says CVE-2015-3306 is being exploited for real, but the flaw is eleven years old, the agency's own notes are thin on detail, and it's almost certainly not your problem.
The headline claim
CISA, the US cybersecurity agency, has added CVE-2015-3306 — a vulnerability in the ProFTPD file transfer server — to its Known Exploited Vulnerabilities (KEV) catalogue. The listing states plainly that exploitation is “confirmed, not theoretical”, with the entry added on 8 October 2026 and a compliance deadline of 11 October 2026 for US federal civilian agencies to apply fixes.
That’s a tight turnaround, and the KEV catalogue is generally a reliable signal: CISA only adds a CVE once there’s evidence it’s being used against real systems, not just lab demonstrations.
What the bug actually does
Here’s the catch, and it’s worth being upfront about it: the information CISA and NVD have published in this entry doesn’t spell out the technical mechanism of the attack — no detail on whether this requires authentication, what an attacker gains, or how it’s being chained with other tools. All we can verify from the official record is the basics: it’s a ProFTPD vulnerability, assigned in 2015, and it now appears on a list of flaws with confirmed real-world exploitation. Readers wanting the deeper technical write-up should check the NVD listing directly, since that’s the authoritative source for the vulnerability’s scoring and description.
What we can say with confidence is that this is not a new flaw. A CVE number from 2015 means the bug has existed, and presumably been patchable, for well over a decade. Its sudden appearance on the exploited list in 2026 says more about who’s still running unpatched software than about any new weakness being discovered.
So who is actually at risk
ProFTPD is server software — it runs on machines that host FTP file transfers, typically used by businesses, web hosts, and IT departments, not by ordinary consumers. If you don’t administer a server, you are not affected. There’s no evidence here of a client-side component, a mobile app, or a consumer product being involved.
The firm deadline — 11 October 2026 — applies specifically to US federal civilian agencies, under CISA’s binding operational directive on patching known-exploited flaws. It is not a deadline for the general public, nor for UK organisations, though anyone running ProFTPD anywhere would be sensible to treat “confirmed exploitation” as a reason to act regardless of jurisdiction.
CISA’s entry lists ransomware involvement as “Unknown” — worth noting, because KEV listings that are tied to ransomware campaigns tend to get a lot more public attention and urgency. That’s not flagged here, which suggests this is being exploited in a narrower or less dramatic fashion, even if CISA hasn’t elaborated on what that looks like.
What to do about it
If you or your organisation run ProFTPD, the practical step is straightforward: check which version you’re on, consult ProFTPD’s own advisories, and apply whatever patch or mitigation is appropriate — CISA’s guidance points to following vendor instructions directly. If you don’t run an FTP server, there’s nothing to do.
The takeaway
This is a real, CISA-confirmed exploitation of old, known software — a reminder that “