important · RCE
Any authenticated UTMStack user can send operating-system commands to every connected monitoring agent.
Affects
UTMStack, a SIEM and endpoint-monitoring platform whose server dispatches commands to agents on managed Windows and Linux systems.
The attacker needs a valid UTMStack account of any role and access to the incident-command channel.
Detail and 6 sources
The handler lacks an administrator-role check and a command allowlist before forwarding commands to an agent.
Agents execute the commands as their service identities, commonly root on Linux or SYSTEM on Windows.
UTMStack 11.2.16 was released on October 1, but its notes do not enumerate this security correction.
Sources
ResearchCVE-2026-82041: UTMStack: UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand(),… | Rapid7 Vulnerability DatabaseResearchCVE-2026-82041 - Vulnerability-LookupCode / PoCRelease v11.2.16 · utmstack/UTMStack · GitHubPatchfix(security): patch 7 disclosed CVEs (82039-82045) · utmstack/UTMStack@4e7a727 · GitHubVendorUTMStack < 11.2.16 Missing Authorization via Command WebSocket | Advisories | VulnCheckSecondaryA low-privilege UTMStack user can issue commands across the monitored fleet