Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

UTMStack before 11.2.16 lets any user run system commands

CVE-2026-82041 · published 16 days ago
Summary

The UTMStack monitoring software versions earlier than 11.2.16 allow any logged‑in user to send commands through a web‑socket endpoint without checking their role. Those commands are passed to the agents that run on the monitored machines, which often have full system privileges, so an attacker could cause those machines to execute arbitrary actions. Upgrade to version 11.2.16 or later, or restrict access to the web‑socket endpoint until the update can be applied.

What to do
  • Update utmstack utmstack to version 11.2.16 or later.
Affected software
VendorProductAffected versions
utmstack utmstack < 11.2.16
Original advisory text
UTMStack < 11.2.16 Missing Authorization via Command WebSocket
UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand(), the handler mapped to the /command/{hostname} STOMP destination, where no role check or command allowlist is applied before forwarding supplied commands. Any authenticated user, regardless of role, can send arbitrary operating-system commands over gRPC to any connected agent, resulting in command execution on monitored endpoints where agent processes commonly run as root or SYSTEM.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
6.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published2 Oct 2026
Updated15 Oct 2026
First seen2 Oct 2026
Sources
CVE-2026-82041 · NVD
CVE-2026-82041 · MITRE
CVE-2026-82041 · OSV
Track software like this
Free during beta