UNC Path Injection Vulnerability in Cerberus FTP Server by Cerberus FTP
CVE-2026-82819

7.1HIGH

Key Information:

Vendor

Cerberus

Status
Cerberus Ftp Server
Vendor
CVE Published:
21 October 2026

What is CVE-2026-82819?

A vulnerability in Cerberus FTP Server allows authenticated remote attackers to exploit UNC path injection via a crafted parameter. By providing a malicious SMB share path, attackers can trigger authentication coercion against the underlying server, potentially leading to the exposure of the Cerberus service account's Net-NTLMv2 hash. This vulnerability has been addressed in the latest version of Cerberus FTP Server.

Affected Version(s)

Cerberus FTP Server Windows 0 < 2026.3.0

References

https://www.cerberusftp.com/releasenotes/
release-notes
https://labs.reversec.com/advisories/2026/09/universal-na...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.