{"id":"CVE-2026-82819","kind":"vulnerability","aliases":["CVE-2026-82819"],"related":[],"title":"Cerberus FTP Server: UNC path injection leaks service account NTLM hash","description":"A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter. By supplying a malicious SMB share path, an attacker can execute authentication coercion against the underlying server, resulting in the leakage of the Cerberus service account's Net-NTLMv2 hash. This issue has been resolved in Cerberus FTP Server: 2026.3.0.","summary":"An authenticated user of Cerberus FTP Server can supply a malicious SMB share path through a manipulated parameter. The server then authenticates to that share, leaking the Cerberus service account's Net-NTLMv2 hash that an attacker can try to crack or relay.","severity":"high","cvss":7.1,"epss":0.00457,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cerberus-ftp","other","self-hosted","windows"],"not_affected_if":["auth-required","cerberus-not-deployed"],"how_to_check":"- Check the installed Cerberus FTP Server version against `2026.3.0` in the admin console or the product's About dialog\n- unknown whether the sources name a specific config file or setting to inspect","fix":"- Upgrade Cerberus FTP Server to `2026.3.0` or later\n- After patching, rotate the Cerberus service account password if the server was exposed before the upgrade (inferred from the leak; sources do not say)","status":"open","published_at":"2026-10-21T05:16:43+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:32:01+00:00","updated_at":"2026-10-25T03:32:01+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T03:32:01Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Cerberus FTP Server to `2026.3.0` or later\n- After patching, rotate the Cerberus service account password if the server was exposed before the upgrade (inferred from the leak; sources do not say)","reach":"network","title":"Cerberus FTP Server: UNC path injection leaks service account NTLM hash","impact":"medium","summary":"An authenticated user of Cerberus FTP Server can supply a malicious SMB share path through a manipulated parameter. The server then authenticates to that share, leaking the Cerberus service account's Net-NTLMv2 hash that an attacker can try to crack or relay.","category":"other","nicknames":[],"who_cares":["cerberus-ftp","windows","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Service account Net-NTLMv2 hash leaks to an attacker-controlled SMB share","analyst_note":"Confirm the affected version range and any vendor advisory for CVE-2026-82819 at the NVD page; sources give only the fixed version 2026.3.0.","how_to_check":"- Check the installed Cerberus FTP Server version against `2026.3.0` in the admin console or the product's About dialog\n- unknown whether the sources name a specific config file or setting to inspect","needs_analyst":true,"not_affected_if":["cerberus-not-deployed","auth-required"],"who_is_affected":"Teams that run Cerberus FTP Server with authenticated user accounts, since the attacker must log in first. Exposure depends on the server reaching outbound SMB (ports 445 and similar) and on the service account's credentials being usable for NTLM. Sources do not say which configurations are most at risk, and organizations not running Cerberus can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00066,"input_tokens":3401,"output_tokens":640,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-82819':14A,17A '2026.3.0':130C 'account':9A,55B,115C 'allow':76C 'attack':63B,80C,98C 'authent':27B,47B,78C,101C 'cerberus':1A,19B,30B,53B,73C,113C,127C 'cerberus-ftp':18B 'coercion':102C 'crack':67B 'cve':12A,15A 'execut':100C 'ftp':2A,20B,31B,74C,128C 'hash':11A,60B,120C 'host':24B 'inject':6A,85C 'issu':122C 'leak':7A,51B 'leakag':110C 'malici':36B,93C 'manipul':42B,88C 'net':58B,118C 'net-ntlmv2':57B,117C 'ntlm':10A 'ntlmv2':59B,119C 'paramet':43B,89C 'path':5A,39B,84C,96C 'perform':82C 'relay':69B 'remot':79C 'resolv':125C 'result':107C 'self':23B 'self-host':22B 'server':3A,32B,45B,75C,106C,129C 'servic':8A,54B,114C 'share':38B,50B,95C 'smb':37B,94C 'suppli':34B,91C 'tri':65B 'unc':4A,83C 'under':105C 'user':28B 'via':86C 'vulner':71C 'window':25B","nicknames":[],"mitigations":[],"who_affected":"Teams that run Cerberus FTP Server with authenticated user accounts, since the attacker must log in first. Exposure depends on the server reaching outbound SMB (ports 445 and similar) and on the service account's credentials being usable for NTLM. Sources do not say which configurations are most at risk, and organizations not running Cerberus can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T05:16:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"db4dfee8-a97e-4877-bfae-eba6d14a2166","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82819","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82819","severity":null,"published_at":"2026-10-21T05:16:43+00:00","modified_at":"2026-10-22T17:36:46+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-82819","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-82819","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}