Live › vulnerability › CVE-2026-82819
Go to dashboardAn authenticated user of Cerberus FTP Server can supply a malicious SMB share path through a manipulated parameter. The server then authenticates to that share, leaking the Cerberus service account's Net-NTLMv2 hash that an attacker can try to crack or relay.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run Cerberus FTP Server with authenticated user accounts, since the attacker must log in first. Exposure depends on the server reaching outbound SMB (ports 445 and similar) and on the service account's credentials being usable for NTLM. Sources do not say which configurations are most at risk, and organizations not running Cerberus can skip it.
No product ranges from the sources yet.
2026.3.0 in the admin console or the product's About dialog2026.3.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter. By supplying a malicious SMB share path, an attacker can execute authentication coercion against the underlying server, resulting in the leakage of the Cerberus service account's Net-NTLMv2 hash. This issue has been resolved in Cerberus FTP Server: 2026.3.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-82819")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.