{"id":"CVE-2026-82819","published":"2026-10-21T05:16:43.070","lastModified":"2026-10-22T17:36:46.950","description":"A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter. By supplying a malicious SMB share path, an attacker can execute authentication coercion against the underlying server, resulting in the leakage of the Cerberus service account's Net-NTLMv2 hash. This issue has been resolved in Cerberus FTP Server: 2026.3.0.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-40"],"vendors":[],"products":[],"references":[{"url":"https://labs.reversec.com/advisories/2026/09/universal-naming-convention-unc-path-injection-in-cerberus-ftp-server","tags":[]},{"url":"https://www.cerberusftp.com/releasenotes/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}