Description
A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter. By supplying a malicious SMB share path, an attacker can execute authentication coercion against the underlying server, resulting in the leakage of the Cerberus service account's Net-NTLMv2 hash. This issue has been resolved in Cerberus FTP Server: 2026.3.0.
Published: 2026-10-21
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 05:00:00 +0000

Type Values Removed Values Added
Description A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter. By supplying a malicious SMB share path, an attacker can execute authentication coercion against the underlying server, resulting in the leakage of the Cerberus service account's Net-NTLMv2 hash. This issue has been resolved in Cerberus FTP Server: 2026.3.0.
Title Universal Naming Convention (UNC) Path Injection in Cerberus FTP Server
Weaknesses CWE-40
References
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: NCSC-FI

Published:

Updated: 2026-10-21T04:30:40.808Z

Reserved: 2026-08-31T05:33:33.295Z

Link: CVE-2026-82819

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-21T05:16:43.070

Modified: 2026-10-21T05:16:43.070

Link: CVE-2026-82819

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T16:30:06Z

Weaknesses
  • CWE-40

    Path Traversal: '\\UNC\share\name\' (Windows UNC Share)