What’s Vulnerable › Vulnerabilities

CVE-2026-82819: Universal Naming Convention (UNC) Path Injection in Cerberus FTP Server

• Severity: high (CVSS 7.1 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-21 · updated 2026-10-30
• Weakness: CWE-40

Description

A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter. By supplying a malicious SMB share path, an attacker can execute authentication coercion against the underlying server, resulting in the leakage of the Cerberus service account's Net-NTLMv2 hash. This issue has been resolved in Cerberus FTP Server: 2026.3.0.

Affected products

• Cerberus FTP Server: before 2026.3.0 — fixed in 2026.3.0

How to fix

Upgrade to a fixed version: Cerberus FTP Server 2026.3.0. Check the vendor advisory for mitigations.

References

• https://labs.reversec.com/advisories/2026/09/universal-naming-convention-unc-path-injection-in-cerberus-ftp-server
• https://www.cerberusftp.com/releasenotes/
• https://labs.reversec.com/advisories/2026/09/universal-naming-convention-unc-path-injection-in-cerberus-ftp-server

Get alerted when CVE-2026-82819 or the next vulnerability affects your stack