Universal Naming Convention (UNC) Path Injection in Cerberus FTP Server
Cerberus FTP Server before 2026.3.0 is exposed when its web-based client is enabled for external authenticated users and a UNC path is supplied via relPath with cd left empty. Fixed in 2026.3.0.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 2026.3.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: poc
- Automatable: no
- Technical impact: partial
Summary
A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter. By supplying a malicious SMB share path, an attacker can execute authentication coercion against the underlying server, resulting in the leakage of the Cerberus service account's Net-NTLMv2 hash. This issue has been resolved in Cerberus FTP Server: 2026.3.0.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: poc · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- Cerberus Cerberus FTP Server
fixed in 2026.3.0
References 2
cerberusftp.com
Questions about CVE-2026-82819
What does this mean?
When a UNC path is supplied through the relPath parameter while cd is empty, the server leaks authentication material tied to its configured service account. That material is Net-NTLMv2, which can be captured and cracked offline or used in NTLM relay attacks.Source: labs.reversec.com
Am I affected, and how do I check?
Cerberus FTP Server versions before 2026.3.0 are in scope, but only where the web-based client is enabled for external authenticated users. Check the installed version number and whether that web client is enabled for external users.Source: labs.reversec.com
What should I do about it?
Upgrade Cerberus FTP Server to 2026.3.0 or later, which is the fixed version listed for this issue.Source: labs.reversec.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.Source: cve.now feed data