Cerberus FTP Server CVE-2026-82819

Exploitation requires an authenticated Cerberus FTP Server session (CVSS PR:L) plus the ability to reach a parameter that accepts a path value, into which the attacker injects a UNC/SMB path (e.g., \\attacker-host\share). Successful hash capture additionally requires that the Cerberus server be able to initiate outbound SMB (TCP 139/445) to an attacker-controlled listener - environments that egress-filter outbound SMB substantially limit exploitation. The leaked credential is the Cerberus service account's Net-NTLMv2 hash, so impact depends on that account's privileges and on whether NTLM relay or offline cracking is viable in the environment. Mitigated by upgrading to Cerberus FTP Server 2026.3.0.

Signals point to a moderate, authentication-gated credential-exposure issue rather than a top-tier emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H) confirms network reach with low complexity but explicitly requires privileges (PR:L), meaning the attacker must already be an authenticated Cerberus FTP user - this is the single biggest limiter on real-world risk. The sole confidentiality impact (VC:H, with VI:N/VA:N) aligns with the description's outcome: leakage of the Cerberus service account's Net-NTLMv2 hash, not direct code execution or data tampering. No CISA KEV listing is present and no EPSS score was provided, so there is no public evidence of active exploitation; per precision rules this is 'no public exploit identified at time of analysis.' A key caveat: the real danger is second-order - a captured Net-NTLMv2 hash can be relayed (e.g., NTLM relay to LDAP/SMB) or cracked offline, potentially escalating well beyond the FTP service, yet the CVSS vector keeps SC:N/SI:N/SA:N and does not model that downstream Active Directory risk, so the base score of 7.1 may understate impact in domain-joined deployments. Bottom line: credible, patch-worthy, but gated behind valid credentials and dependent on an exploitable NTLM-relay/cracking path, so prioritize for internet-exposed or multi-tenant Cerberus instances over isolated internal ones.

An attacker with a valid (possibly low-privileged) Cerberus FTP account submits a crafted parameter containing a UNC path pointing to an attacker-controlled SMB listener (e.g., a Responder/ntlmrelayx host). The Cerberus service process attempts to access the share, coercing it to authenticate and transmitting the service account's Net-NTLMv2 hash to the attacker, who then relays or cracks it. No public proof-of-concept was identified at time of analysis; the detailed Reversec Labs advisory describes the technique but no weaponized exploit is confirmed in the provided data.