CISA Orders Federal Agencies to Patch ProFTPD Flaw Exploited by Flax Typhoon

What is the ProFTPD vulnerability?

The US Cybersecurity and Infrastructure Security Agency (CISA) has added a critical flaw in ProFTPD, tracked as CVE-2015-3306, to its Known Exploited Vulnerabilities (KEV) catalogue. ProFTPD is a widely used open-source FTP server. The vulnerability allows remote attackers to read and write to any file on the server by abusing the site cpfr and site cpto commands. This can let attackers steal data or plant malicious files.

CISA's action follows reports that a threat group known as Flax Typhoon, believed to be linked to China, has been exploiting this and four other vulnerabilities to target organisations. The agency has set a deadline of 11 October 2026 for US federal agencies to apply patches or stop using affected systems. This is in line with CISA's policy to prioritise patching of flaws that are actively being used in attacks.CISA↗ (opens in a new tab)

Who is behind the attacks?

According to The Hacker News↗ (opens in a new tab), Flax Typhoon is a China-linked threat actor. The group has been observed exploiting five vulnerabilities, including the ProFTPD flaw, to gain access to networks and steal sensitive data. The campaign has attracted international attention, with agencies from Australia, Canada, Japan, New Zealand, Spain, the UK, and the US issuing a joint advisory. The advisory warns that Chinese government-affiliated actors are positioning themselves inside critical infrastructure networks, possibly to disrupt them in the future.

How are the attacks carried out?

Flax Typhoon reportedly uses a mix of techniques to exploit these vulnerabilities. They scan for unpatched systems, use cross-site scripting, and attempt password spraying attacks (trying many passwords against a single account). Once inside, they establish persistence using VPN software and scripts to exfiltrate emails and credentials. The ProFTPD flaw is just one entry point in a wider campaign.

What should organisations do?

CISA has instructed US federal agencies to patch the ProFTPD vulnerability or discontinue use of the software by 11 October 2026. The agency also recommends following its forensics triage requirements and prioritising updates based on risk. Organisations outside the US federal government should also review their exposure to ProFTPD and apply vendor patches as soon as possible. If a patch is not available, consider disabling or replacing the affected service.

What is the wider context?

This incident highlights the ongoing risk from older, unpatched software. CVE-2015-3306 was first disclosed over a decade ago, but is still being exploited today. Attackers often target known flaws that remain unpatched in public-facing systems. The KEV catalogue maintained by CISA is a useful resource for prioritising patching efforts, as it lists vulnerabilities that are known to be under active attack.

What happens next?

Federal agencies must comply with CISA's deadline or face potential consequences for non-compliance. Other organisations should treat this as a warning to review their own patch management practices. The joint advisory from multiple countries suggests that the threat is being taken seriously at the highest levels. Regular patching and monitoring for signs of compromise remain essential defences.