CVE-2026-82041

Received Received - Intake

UTMStack Missing Authorization Command Execution

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: VulnCheck

Description

UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand(), the handler mapped to the /command/{hostname} STOMP destination, where no role check or command allowlist is applied before forwarding supplied commands. Any authenticated user, regardless of role, can send arbitrary operating-system commands over gRPC to any connected agent, resulting in command execution on monitored endpoints where agent processes commonly run as root or SYSTEM.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-02

Last Modified

2026-10-02

Generated

2026-10-03

AI Q&A

2026-10-03

EPSS Evaluated

N/A

NVD

CVE-2026-82041

EUVD

EUVD-2026-91796

Affected Vendors & Products

Vendor	Product	Version / Range
utmstack	utmstack	to 11.2.16 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

UTMStack before version 11.2.16 has a missing authorization vulnerability in the command processing function UTMIncidentCommandWebsocket.processCommand(). This function handles commands sent to the /command/{hostname} STOMP destination without checking user roles or validating commands against an allowlist. As a result, any authenticated user can send arbitrary operating-system commands via gRPC to connected agents, leading to command execution on monitored endpoints.

Detection Guidance

Check for unauthorized STOMP connections to /command/{hostname} endpoints. Inspect UTMStack agent logs for unexpected gRPC command forwarding. Look for unusual command execution patterns on monitored endpoints.

Impact Analysis

This vulnerability allows any authenticated user to execute arbitrary commands on monitored endpoints where agents run with high privileges like root or SYSTEM. Attackers could gain control over systems, install malware, steal data, or disrupt operations by sending malicious commands through the vulnerable STOMP destination.

Compliance Impact

This vulnerability could lead to unauthorized access and control over systems, violating data protection and security requirements in standards like GDPR and HIPAA. It may result in data breaches, unauthorized data access, or loss of system integrity, all of which are compliance violations requiring breach notifications and potential penalties.

Mitigation Strategies

Upgrade UTMStack to version 11.2.16 or later. Restrict network access to STOMP endpoints. Review and audit user roles and permissions. Monitor for unauthorized command execution.

Hi! I’m here to help you understand CVE-2026-82041. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70