CVE Alert: CVE-2026-82039 – UTMStack

UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder() that allows authenticated attackers to inject arbitrary SQL by supplying malicious assetType and groupName values that are inserted unsanitized into a native PostgreSQL query via String.format(). Attackers can exploit the GET /api/utm-asset-groups/searchGroupsByFilter endpoint to execute arbitrary SQL with DBA privileges, enabling full database read, data modification, and potential filesystem access.

**Risk verdict:** High risk because a low-privilege account could cause severe database impact; exploitation status is unconfirmed, so verify exposure promptly rather than assuming it is being exploited.

**Why this matters:** Database-level access could expose sensitive monitoring data, enable tampering with records or disrupt security operations. Any filesystem access or further compromise would depend on database configuration and service privileges.

**Most likely attack path:** An attacker can reach the function over the network with a valid low-privilege account; exploitation appears straightforward and requires no further user action. Impact is assessed within the vulnerable service’s security scope, though stolen or altered data could affect connected investigations and response workflows.

**Who is most exposed:** Internet- or partner-accessible deployments, and instances where many users or integrations have accounts, warrant particular attention. Internal-only systems remain exposed to compromised credentials or an attacker who has already gained network access.

Review access logs for unusual requests to the asset-group function, especially crafted filter values.

Check database audit and query logs for unexpected statements or errors attributable to the application account.

Look for anomalous database reads, changes, or availability issues after suspicious requests.

Correlate activity with newly used or compromised low-privilege accounts.

Mitigation and prioritisation

Upgrade to the vendor’s fixed release; treat this as urgent for any reachable affected deployment.

Restrict access to the API to trusted networks and minimise account privileges until patched.

Review database permissions and filesystem access available to the application’s database role.

Test the upgrade and monitor application and database behaviour during change rollout.

KEV, SSVC exploitation, PoC and EPSS data were not provided; obtain them to refine urgency.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.