CVE-2026-82045: Utmstack

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

UTMStack before 11.2.16 contains a JPQL injection vulnerability that allows authenticated attackers to read arbitrary entity data by exploiting UtmNetworkScanService.searchPropertyValues(), which builds a JPQL query with String.format() and executes it via em.createQuery() without parameter binding. Attackers can inject malicious JPQL through the value parameter in the GET /api/utm-network-scans/searchPropertyValues endpoint to extract sensitive data including credential tables such as jhi_user.

Affected products

• Utmstack Utmstack: before 11.2.16 (fixed in 11.2.16)

Published 2026-10-02. Last modified 2026-10-06.