UTMStack EUVD-2026-91796

Requires a valid authenticated UTMStack account of ANY role (PR:L) - there is no pre-authentication exposure, but no elevated privilege is needed either, as processCommand() applies no role check or command allowlist on the /command/{hostname} STOMP destination. Exploitation also requires at least one connected agent to target, and the command runs with whatever privilege the agent holds (commonly root or SYSTEM). It works against default configurations before v11.2.16 - no special feature toggle or non-default setting is needed. The primary limiting factors are the authentication requirement (any valid credential) and the presence of connected agents; network reachability to the WebSocket/STOMP endpoint is also required.

The provided CVSS 4.0 base score is 6.5 (Medium), largely because the vendor/NVD vector sets the vulnerable-system impacts to none (VC:N/VI:N/VA:N) while placing total impact on the subsequent system (SC:H/SI:H/SA:H). This under-communicates real-world severity: the flaw yields arbitrary OS command execution on every connected, monitored endpoint, where agents 'commonly run as root or SYSTEM' - effectively fleet-wide RCE from a single low-privileged account. Mitigating signals are PR:L (a valid authenticated account of any role is required, so this is not pre-auth) and the absence of UI. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active or automated exploitation at this time (no public exploit identified). It was reported by VulnCheck (a credible source) and a patch is available. Net assessment: for any organization actually running UTMStack this is a high-priority, low-barrier privilege-escalation-to-RCE issue despite the modest headline 6.5 - the gap between the 6.5 score and the true impact (root/SYSTEM on all agents) is the key takeaway. Real-world urgency is tempered by the niche deployment footprint and the authentication requirement rather than by any technical difficulty of exploitation.

A low-privilege but authenticated UTMStack user (e.g. a read-only analyst or a compromised limited account) opens a STOMP WebSocket to the /command/{hostname} destination and sends an arbitrary operating-system command. Because processCommand() performs no role check or command allowlist, the server forwards it over gRPC to the named agent, executing it as root or SYSTEM on the monitored endpoint. No public exploit was identified at time of analysis, but the attack is trivially scriptable given the AV:N/AC:L vector.