Read the docs
TI-2026-84387 Aliases CVE-2026-121578GHSA-m795-4pj8-4r7f

Stored cross-site scripting in Tactical RMM

Priority MEDIUM 60CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.

Summary

Amidaware Tactical RMM from 0 through 1.6.2 is affected by a stored cross-site scripting flaw (CWE-79). Input is improperly validated or output improperly encoded in various fields, so HTML and JavaScript can be stored in the tools database. An unauthenticated remote attacker can store such code, which runs in the browsers of users who view the infected content and requires user interaction. Successful exploitation can lead to account takeover or code execution.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

Tactical RMM contains a stored XSS vulnerability caused by improperly validated input or encode output for various fields, enabling HTML/JavaScript to be stored in the tools database, which is then executed in the browsers of users when they view content containing the infected objects, leading to account takeover or code execution.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00312 24th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AmidawareTactical RMMup to 1.6.2—No fix listedCNA
  • Tactical RMM VendorAmidaware Affected up to 1.6.2 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Tactical RMM.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-121578
  2. 2026-11-03 CVSS score added · CISA ADP
  3. 2026-11-03 Weakness changed · CISA ADP
  4. 2026-11-03 CISA SSVC decision points changed
  5. 2026-11-03 Priority changed: LOW → MEDIUM
  6. 2026-11-03 Alias added: GHSA-m795-4pj8-4r7f

References

Other 2

  • TI-2025-42874 A Server-Side Template Injection (SSTI) vulnerability in the… CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences