CVE-2026-82819: Universal Naming Convention (UNC) Path Injection in Cerberus FTP Server
Published Oct 21, 2026
·Updated
A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter. By supplying a malicious SMB share path, an attacker can execute authentication coercion against the underlying server, resulting in the leakage of the Cerberus service account's Net-NTLMv2 hash. This issue has been resolved in Cerberus FTP Server: 2026.3.0.
Affected Software
1 affected component
Cerberus Cerberus FTP Server<2026.3.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cerberus FTP Serverto a version that resolves this vulnerability.Fixed in 2026.3.0
Event History
Oct 21, 2026
CVE Published
via MITRE·04:30 AM
Data Sourced
via MITRE·04:30 AM
DescriptionWeakness