JPQL Injection Vulnerability in UTMStack Affects Sensitive Data Retrieval
CVE-2026-82045

7.1HIGH

Key Information:

Vendor

Utmstack

Status
Utmstack
Vendor
CVE Published:
2 October 2026

What is CVE-2026-82045?

The vulnerability in UTMStack allows authenticated attackers to exploit the UtmNetworkScanService.searchPropertyValues() endpoint and inject malicious JPQL queries. This occurs due to improper handling of user input in the GET /api/utm-network-scans/searchPropertyValues method, which uses String.format() without appropriate parameter binding. Consequently, attackers are able to read arbitrary entity data, including sensitive information like credential tables. This flaw underscores the importance of secure coding practices to prevent unauthorized data access.

Affected Version(s)

UTMStack 0 < 11.2.16

References

https://github.com/UTMStack/UTMStack/releases/tag/v11.2.16
release-notes
https://github.com/utmstack/UTMStack/commit/4e7a727c3b8d8...
patch
https://www.vulncheck.com/advisories/utmstack-jpql-inject...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Adam Nurudini (QwesiRED)
VulnCheck
.