Recommended Free Tools
UTMStack’s seven-CVE security cluster affects versions before 11.2.16, according to the October 3, 2026 cluster report. Its highest-rated issue is CVE-2026-82041: an authenticated user could send operating-system commands to connected agents through a STOMP WebSocket because the vulnerable handler did not enforce authorization. UTMStack’s security commit adds a ROLE_ADMIN requirement, and the vendor’s v11.2.16 release is dated October 1, 2026. Operators should verify their installed version and update to 11.2.16 or a later release that includes the fixes.
What CVE-2026-82041 allows
The flaw is missing authorization, not a wholly unauthenticated endpoint. Rapid7’s record says an attacker needs an authenticated account. The vulnerable STOMP destination, /command/{hostname}, reaches UTMIncidentCommandWebsocket.processCommand(); in affected versions, that handler lacked both role checks and a command allowlist. As a result, an authenticated user could submit operating-system commands to agents connected to UTMStack.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
BookFactory Security Pass Down Log Book, Wire-O, 100 Pages | $22.99 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
That distinction matters when assessing exposure: the reported precondition is an account, while the potential impact can extend from the UTMStack server to its connected agents. Rapid7 assigns CVE-2026-82041 a CVSS 3.1 base score of 9.9 (Critical) and a CVSS 4.0 base score of 6.5 (Medium). These are severity scores, not probabilities of exploitation or estimates of affected organizations.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
All seven CVEs in the reported cluster
ThreatAft’s October 3, 2026 cluster report attributes the following CVSS 3.1 scores to the seven issues. The patch descriptions below are from UTMStack’s security commit.
#1 Best Overall
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
| CVE | Reported issue | CVSS 3.1 | Patch described by UTMStack |
|---|---|---|---|
| CVE-2026-82039 | SQL injection in asset-group search | 8.8 | Parameterizes the native search query and allowlists sort columns. |
| CVE-2026-82040 | SSRF in identity-provider metadata URL validation | 5.0 | Restricts metadata URLs to public HTTP(S) hosts, rejects literal IPs and local address resolutions, and disallows redirects. |
| CVE-2026-82041 | Missing authorization in the command WebSocket | 9.9 | Requires ROLE_ADMIN in the command handler. |
| CVE-2026-82042 | Internal-key authentication bypass | 9.8 | Limits internal-key authentication to an allowlist of machine-to-machine routes, logs accepted key use, and supports optional INTERNAL_KEY_ALLOWED_CIDRS; constant-time key comparison is retained. |
| CVE-2026-82043 | Account enumeration through password reset | 5.3 | Returns a generic successful response with an empty body when password reset is initiated, preventing callers from distinguishing unknown accounts. |
| CVE-2026-82044 | SSRF in PDF generation | 7.7 | Restricts PDF report URLs to relative paths under known print/export prefixes. |
| CVE-2026-82045 | JPQL injection in network-scan property search | 6.5 | Binds the searched value in the network-scan property query. |
The CVSS 3.1 figures in this table are ThreatAft’s reported scores, not a common score published for every issue by Rapid7. UTMStack’s commit is the primary source for the technical changes; the unified list and scores are from the secondary cluster report.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Which UTMStack versions are affected, and what fixes them?
The October 3 cluster report says versions before 11.2.16 are affected. UTMStack published v11.2.16 on October 1, 2026, and the associated repository security commit identifies patches for the seven disclosed CVEs numbered 82039 through 82045. The release page itself summarizes alert changes rather than listing those security fixes, so the connection between the release and the cluster is established by the security commit and the cluster report together.
- Check the version currently installed in each UTMStack deployment.
- Update to v11.2.16 or a later release that includes the seven fixes.
- Confirm the upgrade completed and that the running deployment reports the intended version.
The available disclosure does not identify a separate workaround that substitutes for installing the fixes.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsWhat operators should check after updating
The vendor commit documents code changes, not a full incident-response procedure. As prudent follow-up, administrators should review command/WebSocket activity and administrative API access for anomalies, and assess how the INTERNAL_KEY is stored, who can access it, and whether it may have been exposed. The commit makes INTERNAL_KEY_ALLOWED_CIDRS optional; its route allowlist is always enabled by the described fix.
What is known about exploitation?
As of Rapid7’s October 2, 2026 record, the issue was not listed in CISA’s Known Exploited Vulnerabilities catalog. ThreatAft’s October 3 article said it was not tracking a public exploit and likewise reported no KEV listing. These are dated status snapshots: they do not establish that no one has exploited the flaws, and they may change after publication.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
