{"schema":"threatline.record/2","record":{"id":"CVE-2026-82819","aliases":[],"summary":"Universal Naming Convention (UNC) Path Injection in Cerberus FTP Server","details":"A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter. By supplying a malicious SMB share path, an attacker can execute authentication coercion against the underlying server, resulting in the leakage of the Cerberus service account's Net-NTLMv2 hash. This issue has been resolved in Cerberus FTP Server: 2026.3.0.","categories":["Unclassified"],"product":"Cerberus FTP Server","vendor":"Cerberus","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-82819","source_modified_at":"2026-10-21T04:30:40.808Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Cerberus FTP Server","vendor":"Cerberus","versions":[{"status":"affected","version":"0","lessThan":"2026.3.0","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-82819","source_modified_at":"2026-10-21T04:30:40.808Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Cerberus FTP Server","ecosystem":null},"version":"2026.3.0","basis":"first unaffected version stated in the CVE record"}],"cvss":7.1,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00457,"percentile":0.38714,"score_date":"2026-10-23"},"published_at":"2026-10-21T04:30:40.808Z","modified_at":"2026-10-21T04:30:40.808Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-82819","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-21T04:30:40.808Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-82819","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.cerberusftp.com/releasenotes/","tags":["release-notes"]},{"source":"CVE List","url":"https://labs.reversec.com/advisories/2026/09/universal-naming-convention-unc-path-injection-in-cerberus-ftp-server","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-21T04:30:40.808Z","content_hash":"13193a5b988c1d2ac8e8eb4ecda7e64a66255c5d620ef5e0931ae642fb000771"}}