UTMStack: SQL injection via asset group search filter
Summary
UTMStack, an open-source SIEM and XDR platform, contains an SQL injection flaw in the asset group search (CWE-89). An authenticated user with a low-privilege account can send crafted assetType and groupName values to GET /api/utm-asset-groups/searchGroupsByFilter, and these values are inserted unsanitized into a PostgreSQL query. Successful exploitation can run arbitrary SQL with DBA privileges, which allows reading and modifying the full database and possibly accessing the file system. No user interaction is required.
Affected
- UTMStack versions before 11.2.16 (all versions below 11.2.16 according to the CVE record)
Fixed in
- UTMStack 11.2.16 (release dated 1 Oct 2026)
- Fix commit referenced by the CVE record: 4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd
- Note: the release notes do not name this SQL injection explicitly, so verify the fix in the vendor advisory.
Workaround
Unknown. No vendor mitigation is documented.
- Interim measures (not from the vendor): limit the number of UTMStack accounts, restrict access to the management interface to internal networks or VPN, and review access logs for requests to /api/utm-asset-groups/searchGroupsByFilter.
Exploitation
- No known exploitation.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Not listed in CISA KEV at the time of research.
- No public proof of concept found.
Our recommendation
- Upgrade UTMStack to version 11.2.16 or later, and confirm the fix in the vendor advisory.
- Until the upgrade is done, restrict access to the UTMStack web interface to trusted networks or VPN.
- Review user accounts and remove unneeded ones.
- Check logs for unusual requests to the searchGroupsByFilter endpoint.
- Back up the database and monitor it for unexpected changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory: UTMStack SQL injection via searchGroupsByFilter www.vulncheck.com
- UTMStack release v11.2.16 github.com
- UTMStack fix commit 4e7a727 github.com
- OSV: CVE-2026-82039 osv.dev
- VulDB: CVE-2026-82039 vuldb.com
- Red Packet Security CVE alert: CVE-2026-82039 www.redpacketsecurity.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:44.
Original description (NVD)
UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder() that allows authenticated attackers to inject arbitrary SQL by supplying malicious assetType and groupName values that are inserted unsanitized into a native PostgreSQL query via String.format(). Attackers can exploit the GET /api/utm-asset-groups/searchGroupsByFilter endpoint to execute arbitrary SQL with DBA privileges, enabling full database read, data modification, and potential filesystem access.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.