CVE WatchNov 3, 2026

CVE-2026-121578

Tactical RMM contains a stored XSS vulnerability caused by improperly validated input or encode output for various fields, enabling HTML/Jav

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Nov 3, 2026 · Last modified: Nov 3, 2026

EPSS · 30d

Not enough EPSS history yet.

Technical description

Tactical RMM contains a stored XSS vulnerability caused by improperly validated input or encode output for various fields, enabling HTML/JavaScript to be stored in the tools database, which is then executed in the browsers of users when they view content containing the infected objects, leading to account takeover or code execution.

Official references

github.comhttps://github.com/Kuri119/Stored-XSS-In-Tactical-RMM-1.5.2/tree/main
github.comhttps://github.com/amidaware/tacticalrmm-web/commit/ba5363ea99cf776511e5c828b6d744e4d0bddd08

Related CVEs

No related CVEs by CWE or product.