Is CVE-2026-82039 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82039 being exploited in the wild.

How severe is CVE-2026-82039?

High severity, with a CVSS score of 8.8, published 2 October 2026.

Is there a fix for CVE-2026-82039?

Yes: fixed in UTMStack 11.2.16. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82039 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-82039?

Check whether you run UTMStack at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82039: UTMStack SQL injection in asset group search

CVE-2026-82039 · Severity: high · CVSS 8.8 · Published 2026-10-02

UTMStack is a security management platform that monitors and manages IT assets and threats. A SQL injection vulnerability in the asset group search endpoint allows authenticated users to inject malicious SQL commands that execute with database administrator privileges, potentially exposing or modifying all data stored in the system.

Technologies: UTMStack. Vendors: UTMStack.

Quick answers

Is CVE-2026-82039 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82039 being exploited in the wild.
How severe is CVE-2026-82039?: High severity, with a CVSS score of 8.8, published 2 October 2026.
Which products and versions are affected?: UTMStack before 11.2.16.
Is there a fix for CVE-2026-82039?: Yes: fixed in UTMStack 11.2.16. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82039 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-82039?: Check whether you run UTMStack at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: UTMStack 11.2.16

Technical details

The UtmAssetGroupService.searchQueryBuilder() method constructs native PostgreSQL queries using String.format() with unsanitized assetType and groupName parameters supplied via the GET /api/utm-asset-groups/searchGroupsByFilter endpoint. An authenticated attacker can inject arbitrary SQL to read, modify, or delete data with DBA privileges. The fix parameterizes the native query and restricts sort columns to an allowlist.

Affected products

UTMStack UTMStack before 11.2.16

Timeline

2026-10-02: disclosed
2026-10-01: patched: v11.2.16 released 2026-10-01; security fix committed 2026-08-31

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.