CVE-2026-82819Universal Naming Convention (UNC) Path Injection in Cerberus FTP Server

Açıklama

A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter. By supplying a malicious SMB share path, an attacker can execute authentication coercion against the underlying server, resulting in the leakage of the Cerberus service account's Net-NTLMv2 hash. This issue has been resolved in Cerberus FTP Server: 2026.3.0.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• https://www.cerberusftp.com/releasenotes/ release-notes
• https://labs.reversec.com/advisories/2026/09/universal-naming-convention-unc-path-injection-in-cerberus-ftp-server third-party-advisory