A flaw in Cerberus FTP Server lets an authenticated attacker perform UNC path injection by supplying a malicious SMB share path. The injection coerces the underlying server into authenticating with the service account, causing the leak of the Cerberus service account's Net‑NTLMv2 hash. The compromise exposes credential material that an adversary could use for lateral movement or further privilege escalation. The weakness is classified as CWE‑40.

The vulnerability affects Cerberus FTP Server installations that are older than version 2026.3.0. The effective fix was released in Cerberus FTP Server 2026.3.0, removing the ability to inject UNC paths and protect the service account hash.

The vulnerability carries a CVSS score of 7.1 and an EPSS score of less than 1%, indicating a high severity but currently low exploitation probability. The attacker must first have authenticated access to the FTP server, after which the UNC injection can be executed to coerce authentication against the underlying SMB services. The issue is not listed in CISA KEV, but the credential leakage presents a significant risk if exploited.