# CVE-2026-82041: UTMStack missing authorization in incident command websocket

Source: https://junglewise.ai/threats/cve-2026-82041-utmstack-before-11-2-16-contains-a-missing-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-02. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-82041 · Severity: critical · CVSS 9.9 · Published 2026-10-02

UTMStack is a security monitoring and incident response platform that manages alerts and connected agents across an organization's infrastructure. An authenticated user with any role can send arbitrary operating-system commands to any monitored endpoint through a websocket handler, potentially compromising thousands of systems where agent processes typically run with administrative privileges.

Technologies: [UTMStack](https://junglewise.ai/threats/technologies/utmstack). Vendors: [UTMStack](https://junglewise.ai/threats/vendors/utmstack).

## Quick answers

**Is CVE-2026-82041 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82041 being exploited in the wild.

**How severe is CVE-2026-82041?** Critical severity, with a CVSS score of 9.9, published 2 October 2026.

**Which products and versions are affected?** UTMStack before 11.2.16.

**Is there a fix for CVE-2026-82041?** Yes: fixed in 11.2.16. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82041 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-82041?** Check whether you run UTMStack at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 11.2.16

## Technical details

The UTMIncidentCommandWebsocket.processCommand() handler, mapped to the /command/{hostname} STOMP destination, fails to enforce role-based access control or command validation before forwarding commands via gRPC to connected agents. An authenticated attacker can send arbitrary OS commands regardless of their assigned role; agents commonly execute with root or SYSTEM privileges, granting full system compromise.

## Affected products

- UTMStack UTMStack before 11.2.16

## Timeline

- 2026-10-02: disclosed
- 2026-10-01: patched

## References

- [https://github.com/UTMStack/UTMStack/releases/tag/v11.2.16](https://github.com/UTMStack/UTMStack/releases/tag/v11.2.16)
- [https://github.com/utmstack/UTMStack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd](https://github.com/utmstack/UTMStack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd)

## Related threats

- [UTMStack JPQL injection via network scan property search](https://junglewise.ai/threats/cve-2026-82045-utmstack-before-11-2-16-contains-a-jpql-injection-vulnerability)
- [UTMStack server-side request forgery in PDF generation](https://junglewise.ai/threats/cve-2026-82044-utmstack-before-11-2-16-contains-a-server-side-request-forgery)
- [UTMStack account enumeration via password reset endpoint](https://junglewise.ai/threats/cve-2026-82043-utmstack-before-11-2-16-contains-an-account-enumeration)
- [UTMStack authentication bypass via internal API key header](https://junglewise.ai/threats/cve-2026-82042-utmstack-before-11-2-16-contains-an-authentication-bypass)
- [UTMStack server-side request forgery in IdentityProviderService](https://junglewise.ai/threats/cve-2026-82040-utmstack-before-11-2-16-contains-a-server-side-request-forgery)