CVE-2026-82045: UTMStack < 11.2.16 JPQL Injection via searchPropertyValues
UTMStack before 11.2.16 contains a JPQL injection vulnerability that allows authenticated attackers to read arbitrary entity data by exploiting UtmNetworkScanService.searchPropertyValues(), which builds a JPQL query with String.format() and executes it via em.createQuery() without parameter binding. Attackers can inject malicious JPQL through the value parameter in the GET /api/utm-network-scans/searchPropertyValues endpoint to extract sensitive data including credential tables such as jhiuser.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated UTMStack account with access to the GET /api/utm-network-scans/searchPropertyValues endpoint. No user interaction is required, and the attack can be performed remotely over the network.
What can an attacker obtain through exploitation?
The issue allows reading arbitrary entity data through injected JPQL. This can include sensitive credential-related tables such as jhi_user; the provided information does not indicate an integrity or availability impact.
Which versions need remediation?
UTMStack versions before 11.2.16 are affected. Upgrading to version 11.2.16 or later addresses the vulnerable query construction.
What can be done if an upgrade cannot be applied immediately?
Restrict access to the affected endpoint to only trusted authenticated users, since exploitation requires authentication. Review which accounts can reach /api/utm-network-scans/searchPropertyValues and limit network exposure where possible.