Vulnerability Description
A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter. By supplying a malicious SMB share path, an attacker can execute authentication coercion against the underlying server, resulting in the leakage of the Cerberus service account's Net-NTLMv2 hash. This issue has been resolved in Cerberus FTP Server: 2026.3.0.
Related Weaknesses (CWE)
References
- https://labs.reversec.com/advisories/2026/09/universal-naming-convention-unc-pat
- https://www.cerberusftp.com/releasenotes/
- https://labs.reversec.com/advisories/2026/09/universal-naming-convention-unc-pat
FAQ
What is CVE-2026-82819?
CVE-2026-82819 is a documented vulnerability. A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter. By supplying a malicious SMB share path, an attacker can execu...
How severe is CVE-2026-82819?
CVSS scoring is not yet available for CVE-2026-82819. Check NVD for updates.
Is there a patch for CVE-2026-82819?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.