[ CVE-2026-82041 · Published 2 Oct 2026 ]
Vulnerability in UTMStack
CVSS 9.9
EPSS <1%No fix listed yet
[ Why it matters ]Priority signals
- Critical severity: CVSS 9.9
[ Description ]Official description
UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand(), the handler mapped to the /command/{hostname} STOMP destination, where no role check or command allowlist is applied before forwarding supplied commands. Any authenticated user, regardless of role, can send arbitrary operating-system commands over gRPC to any connected agent, resulting in command execution on monitored endpoints where agent processes commonly run as root or SYSTEM.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.