CVE-2026-82819 — Universal Naming Convention (UNC) Path Injection in Cerberus FTP Server
A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter. By supplying a malicious SMB share path…
Published: 2026-10-21 · CVSS: 7.1 · CVSS 4.0
A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter. By supplying a malicious SMB share path, an attacker can execute authentication coercion against the underlying server, resulting in the leakage of the Cerberus service account's Net-NTLMv2 hash. This issue has been resolved in Cerberus FTP Server: 2026.3.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7