CVE-2026-82819 Details
Description
A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter. By supplying a malicious SMB share path, an attacker can execute authentication coercion against the underlying server, resulting in the leakage of the Cerberus service account's Net-NTLMv2 hash. This issue has been resolved in Cerberus FTP Server: 2026.3.0.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No CVSS 3.x data is available for this CVE.
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://labs.reversec.com/advisories/2026/09/universal-naming-convention-unc-path-injection-in-cerberus-ftp-server | CISA-ADP | |
| https://labs.reversec.com/advisories/2026/09/universal-naming-convention-unc-path-injection-in-cerberus-ftp-server | National Cyber Security Centre Finland | |
| https://www.cerberusftp.com/releasenotes/ | National Cyber Security Centre Finland |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-40 | Path Traversal: '\\UNC\share\name\' (Windows UNC Share) | National Cyber Security Centre Finland |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | National Cyber Security Centre Finland |