CVE-2026-82819

Published: Ott 21, 2026 Last Modified: Ott 21, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 7,1
Source: db4dfee8-a97e-4877-bfae-eba6d14a2166
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A

Description

AI Translation Available

A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter. By supplying a malicious SMB share path, an attacker can execute authentication coercion against the underlying server, resulting in the leakage of the Cerberus service account's Net-NTLMv2 hash. This issue has been resolved in Cerberus FTP Server: 2026.3.0.

40

Path Traversal: '\\UNC\share\name\' (Windows UNC Share)

Draft
Abstraction: Variant Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Integrity
Potential Impacts:
Read Files Or Directories Modify Files Or Directories
Applicable Platforms
All platforms may be affected
View CWE Details
https://labs.reversec.com/advisories/2026/09/universal-nami…
https://labs.reversec.com/advisories/2026/09/universal-naming-convention-unc-pa…
https://www.cerberusftp.com/releasenotes/
https://www.cerberusftp.com/releasenotes/