CVE-2026-82045

Name of the Vulnerable Software and Affected Versions UTMStack versions prior to 11.2.16

Description Authenticated attackers can read arbitrary entity data by exploiting a JPQL injection issue. The vulnerability exists in the UtmNetworkScanService.searchPropertyValues() function, which constructs a JPQL query using String.format() and executes it via em.createQuery() without proper parameter binding. By sending malicious JPQL through the value parameter in the 'GET /api/utm-network-scans/searchPropertyValues' endpoint, attackers can extract sensitive information, including credential tables such as jhi user. JPQL (Java Persistence Query Language) is an object-oriented query language used to perform database operations on entities.

Recommendations Update UTMStack to version 11.2.16 or later. As a temporary mitigation, restrict access to the 'GET /api/utm-network-scans/searchPropertyValues' endpoint or avoid using the value parameter until the update is applied.