Vulnerability · Published Oct 2, 2026 · Assigned by VulnCheck

CVE-2026-82041UTMStack < 11.2.16 Missing Authorization via Command WebSocket

Critical 9.9

In plain English

A critical-severity missing authorization in UTMStack from UTMStack. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.1)9.9Critical

Exploit odds (30 days)0.4%top 61.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand(), the handler mapped to the /command/{hostname} STOMP destination, where no role check or command allowlist is applied before forwarding supplied commands. Any authenticated user, regardless of role, can send arbitrary operating-system commands over gRPC to any connected agent, resulting in command execution on monitored endpoints where agent processes commonly run as root or SYSTEM.

Affected products (as reported)

Vendor	Product	Versions
UTMStack	UTMStack	0 – before 11.2.16

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

UTMStack v11.2.16 Release Notes release-notes
Patch Commit patch
https://www.vulncheck.com/advisories/utmstack-missing-authorization-via-command-websocket third-party-advisory