CVE-2026-82819

{
  "etk_id": "ETK-2026-2288",
  "cve_id": "CVE-2026-82819",
  "display_id": "CVE-2026-82819",
  "ghsa_id": "GHSA-jxgv-cgf3-xqr5",
  "euvd_id": "EUVD-2026-107041",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authenticated UNC path injection in Cerberus FTP Server",
  "summary": "Cerberus FTP Server installations that have not been updated to 2026.3.0 are affected by UNC path injection. An authenticated remote user can induce SMB authentication from the server and obtain the service account's Net-NTLMv2 hash; access to a valid account is required.",
  "mitigation": "Upgrade Cerberus FTP Server to version 2026.3.0. Restrict untrusted authenticated users until the update is deployed.",
  "vendor": "Cerberus",
  "product": "Cerberus FTP Server",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 2026.3.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2026.3.0"
      ],
      "package_name": "Cerberus FTP Server",
      "purl": null
    }
  ],
  "cwes": [
    40
  ],
  "cvss_score": 7.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 10.3880716,
  "t0_at": "2026-10-21T04:30:40.808000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-21T04:30:40.808000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-21T04:30:40.808000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-82819"
    }
  }
}