CVE-2026-82045 in UTMStack
Summary
by MITRE • 10/03/2026
UTMStack before 11.2.16 contains a JPQL injection vulnerability that allows authenticated attackers to read arbitrary entity data by exploiting UtmNetworkScanService.searchPropertyValues(), which builds a JPQL query with String.format() and executes it via em.createQuery() without parameter binding. Attackers can inject malicious JPQL through the value parameter in the GET /api/utm-network-scans/searchPropertyValues endpoint to extract sensitive data including credential tables such as jhi_user.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/03/2026
The vulnerability identified in UTMStack versions prior to 11.2.16 represents a critical security flaw rooted in improper neutralization of special elements used in an object persistence language, specifically categorized under CWE-94 as Improper Control of Generation of Code or Script known as Injection. This specific instance manifests as Java Persistence Query Language injection within the UtmNetworkScanService.searchPropertyValues method. The core technical deficiency lies in the construction of database queries using String.format() to embed user-supplied input directly into the query string without employing parameter binding mechanisms such as prepared statements or named parameters. By bypassing these standard security controls, the application fails to distinguish between executable code and data input, allowing an attacker to manipulate the intended logic of the JPQL statement.
An authenticated attacker can exploit this flaw by targeting the GET /api/utm-network-scans/searchPropertyValues endpoint with a specially crafted value parameter. Because the system concatenates this input directly into the query before execution via em.createQuery(), malicious syntax injected through the value field alters the structure of the database command. This capability enables arbitrary data extraction from the underlying persistence layer, bypassing normal application-level access controls and business logic restrictions. The impact is severe as it grants unauthorized read access to sensitive entity data stored within the system's database.
The operational impact of this vulnerability extends beyond simple information disclosure. Attackers can leverage this injection point to extract credential tables such as jhi_user, which typically contain usernames, password hashes, and other authentication-related metadata. Compromise of these credentials facilitates further lateral movement within the network environment or allows for privilege escalation if weak hashing algorithms are employed. This aligns with ATT&CK technique T1078, Valid Accounts, where adversaries use legitimate user accounts to maintain access and move laterally without triggering typical intrusion detection systems that focus on external threats.
Mitigation strategies must prioritize immediate patching of the UTMStack software to version 11.2.16 or higher, which addresses this specific code path by implementing proper parameterized queries. In environments where upgrading is not immediately feasible, network-level controls such as Web Application Firewalls can be configured to detect and block anomalous JPQL syntax patterns in API requests targeting the searchPropertyValues endpoint. Additionally, developers should conduct a thorough review of all data access layers that utilize String.format() or similar string concatenation methods for query construction, replacing them with parameterized alternatives to ensure strict separation between code and data inputs across the entire application stack.