CVE-2026-82819

Awaiting Analysis Awaiting Analysis - Queue

UNC Path Injection in Cerberus FTP Server Leads to Net-NTLMv2 Hash Leak

Publication date: 2026-10-21

Last updated on: 2026-10-30

Assigner: National Cyber Security Centre Finland

Description

A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter. By supplying a malicious SMB share path, an attacker can execute authentication coercion against the underlying server, resulting in the leakage of the Cerberus service account's Net-NTLMv2 hash. This issue has been resolved in Cerberus FTP Server: 2026.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-82819

EUVD

EUVD-2026-107041

Affected Vendors & Products

Vendor	Product	Version / Range
Cerberus	Cerberus FTP Server	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-40	The product accepts input that identifies a Windows UNC share ('\\UNC\share\name') that potentially redirects access to an unintended location or arbitrary file.

Attack-Flow Graph

Executive Summary

CVE-2026-82819 is a UNC path injection vulnerability in Cerberus FTP Server versions before 2026.3.0. It allows authenticated remote attackers to manipulate a parameter and supply a malicious SMB share path. This forces the Cerberus service account to authenticate to an attacker-controlled host, leaking its Net-NTLMv2 hash. The issue occurs via the relPath parameter in the /file/json/check-upload endpoint.

Detection Guidance

To detect this vulnerability, monitor network traffic for UNC path injection attempts targeting the Cerberus FTP Server. Check logs for suspicious relPath parameter values containing SMB share paths in requests to /file/json/check-upload. Use packet capture tools like Wireshark to inspect authentication attempts from the Cerberus service account to unknown hosts.

Impact Analysis

An attacker could capture the leaked Net-NTLMv2 hash and use it in offline brute-force or NTLM relay attacks. This may lead to unauthorized access to systems or data if the service account has elevated privileges. The vulnerability requires an authenticated user but enables further exploitation beyond the FTP server.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive credentials (Net-NTLMv2 hash) through UNC path injection. If exploited, it may lead to data breaches, unauthorized access to protected data, or lateral movement within systems, violating confidentiality and integrity requirements of these regulations.

Mitigation Strategies

Immediately update Cerberus FTP Server to version 2026.3.0 or later to patch the vulnerability. If updating is not possible, restrict access to the /file/json/check-upload endpoint and block outbound SMB traffic from the Cerberus service account to prevent hash leakage.

Hi! I’m here to help you understand CVE-2026-82819. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...