CVE-2026-82039: Utmstack

High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days.

UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder() that allows authenticated attackers to inject arbitrary SQL by supplying malicious assetType and groupName values that are inserted unsanitized into a native PostgreSQL query via String.format(). Attackers can exploit the GET /api/utm-asset-groups/searchGroupsByFilter endpoint to execute arbitrary SQL with DBA privileges, enabling full database read, data modification, and potential filesystem access.

Affected products

• Utmstack Utmstack: before 11.2.16 (fixed in 11.2.16)

Published 2026-10-02. Last modified 2026-10-06.