CVE-2026-82041 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-82041 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-82041 is a critical authorization flaw in UTMStack before 11.2.16 that can let any authenticated user send arbitrary operating-system commands to connected agents. The vulnerable handler, UTMIncidentCommandWebsocket.processCommand(), accepts commands for the /command/{hostname} STOMP destination without checking user role or enforcing a command allowlist. In practice, this can lead to remote command execution on monitored endpoints, often with root or SYSTEM privileges where agents run with elevated rights.

Severity: Critical (CVSS 9.9)
KEV: No
Exploited in the wild: No known public exploitation at time of writing

Immediate Action

  • Upgrade immediately to UTMStack 11.2.16 or later. If you cannot patch right away, treat the service as exposed to full remote command execution by any authenticated account.
  • Restrict access to the UTMStack web UI and STOMP/WebSocket endpoints to a trusted admin network or VPN only.
  • Disable or isolate the command execution feature if your deployment allows it; otherwise, take the service offline until patched.
  • Review all authenticated accounts and remove stale, shared, or low-trust users immediately.
  • Check vendor guidance and release notes for 11.2.16: Vendor advisory / release notes
  • Assume endpoint compromise is possible if untrusted users had access; begin incident review for suspicious commands, agent activity, and lateral movement.

Affected Versions

  • UTMStack < 11.2.16 vulnerable
  • UTMStack 11.2.16+ fixed / safe
  • UTMStack 11.2.16 is the minimum known safe version based on current advisory data

Resolution Guide

Best fix: upgrade UTMStack to the patched release as soon as possible. If you use containers, redeploy with the fixed image tag. If you package UTMStack internally, update your deployment manifest to the patched version and restart the service.

# Generic upgrade (replace with your deployment method)
# TODO: use your vendor-provided installer or package name
sudo systemctl stop utmstack
sudo <vendor-upgrade-command> 11.2.16
sudo systemctl start utmstack

Docker / containerized deployments

# TODO: replace with the vendor's fixed image tag
docker pull utmstack/utmstack:11.2.16
docker stop utmstack
docker rm utmstack
docker run -d --name utmstack utmstack/utmstack:11.2.16

Linux package managers

# Debian/Ubuntu
sudo apt-get update
sudo apt-get install --only-upgrade utmstack=11.2.16

# RHEL/CentOS/Fedora
sudo yum update utmstack-11.2.16
# or
sudo dnf upgrade utmstack-11.2.16

Java / build-based deployments (if UTMStack is embedded or repackaged internally)

<dependency>
  <groupId>TODO.vendor</groupId>
  <artifactId>utmstack</artifactId>
  <version>11.2.16</version>
</dependency>

dependencies {
  implementation "TODO.vendor:utmstack:11.2.16"
}

JavaScript / Python package managers are unlikely to apply directly to UTMStack itself, but if your team wraps or automates it, pin the fixed release in your deployment tooling:

# npm / yarn / pnpm (deployment wrapper only)
npm i -D TODO-wrapper@latest
yarn add -D TODO-wrapper@latest
pnpm add -D TODO-wrapper@latest

# pip / pipx (automation scripts only)
pip install --upgrade TODO-wrapper
pipx upgrade TODO-wrapper

Hardening while you patch

# Example: restrict access at the firewall
sudo ufw allow from <admin-vpn-subnet> to any port <utmstack-port>
sudo ufw deny <utmstack-port>

# Example: reverse proxy access control
# Only allow trusted IP ranges to reach /command/*
location /command/ {
  allow 10.0.0.0/8;
  deny all;
}

Minimal code fix example if you maintain a fork or need to validate the vendor patch:

// Before forwarding commands, enforce role checks and an allowlist.
public void processCommand(User user, String hostname, String command) {
    if (!user.hasRole("ADMIN")) {
        throw new AccessDeniedException("Unauthorized");
    }

    if (!ALLOWED_COMMANDS.contains(command)) {
        throw new IllegalArgumentException("Command not allowed");
    }

    forwardToAgent(hostname, command);
}

Detection & Verification

Check your version first. If you run UTMStack, confirm whether the installed version is below 11.2.16.

# Linux package check
dpkg -l | grep -i utmstack
rpm -qa | grep -i utmstack

# Service / container check
utmstack --version 2>/dev/null || true
docker image ls | grep -i utmstack
docker inspect utmstack --format '{{.Config.Image}}'

Search for the vulnerable handler in source, build artifacts, or deployed code:

grep -R "processCommand" .
grep -R "/command/{hostname}" .
grep -R "UTMIncidentCommandWebsocket" .

Verify the fix by confirming the patched version and testing access control:

# Confirm version is 11.2.16 or later
utmstack --version

# Confirm unauthorized users are blocked
# Expect 403/denied responses for non-admin accounts
curl -i -u lowpriv:user https://<host>/command/testhost

Audit logs for suspicious command activity, especially commands issued by non-admin users, unusual hostnames, or bursts of websocket/STOMP traffic. If you have SIEM access, look for command execution events on endpoints shortly after user logins.

Risk and Impact

This flaw can turn a normal authenticated account into a full remote-control path for every connected agent. Because agents commonly run with elevated privileges, the blast radius includes endpoint takeover, credential theft, malware deployment, data destruction, and lateral movement across your environment.

For solo developers and small teams, the biggest risk is assuming “authenticated” means “safe.” If any non-admin user can reach the service, patching and access restriction should be treated as urgent.

Keep reading