Is CVE-2026-82043 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82043 being exploited in the wild.

How severe is CVE-2026-82043?

Medium severity, with a CVSS score of 5.3, published 2 October 2026.

Is there a fix for CVE-2026-82043?

Yes: fixed in 11.2.16. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82043 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-82043?

Check whether you run UTMStack at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82043: UTMStack account enumeration via password reset endpoint

CVE-2026-82043 · Severity: medium · CVSS 5.3 · Published 2026-10-02

UTMStack is a security information and event management (SIEM) platform used to monitor and analyze security events across enterprise networks. An unauthenticated attacker can determine which email addresses are registered in the system by sending password reset requests and observing different HTTP responses, enabling targeted phishing or credential stuffing attacks against legitimate users.

Technologies: UTMStack. Vendors: UTMStack.

Quick answers

Is CVE-2026-82043 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82043 being exploited in the wild.
How severe is CVE-2026-82043?: Medium severity, with a CVSS score of 5.3, published 2 October 2026.
Which products and versions are affected?: UTMStack before 11.2.16.
Is there a fix for CVE-2026-82043?: Yes: fixed in 11.2.16. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82043 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-82043?: Check whether you run UTMStack at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 11.2.16

Technical details

The POST /api/account/reset-password/init endpoint in UTMStack before 11.2.16 discloses account registration status through differential HTTP responses: registered accounts return 200 OK while unregistered accounts trigger a 500 Internal Server Error. This information disclosure allows unauthenticated attackers to enumerate valid user accounts without authentication requirements. The vulnerability is fixed in version 11.2.16 by making the endpoint always return 200 with an empty body regardless of account existence.

Affected products

UTMStack UTMStack before 11.2.16

Timeline

2026-10-02: disclosed
2026-10-01: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.