CVE-2026-121578 Details
Description
Tactical RMM contains a stored XSS vulnerability caused by improperly validated input or encode output for various fields, enabling HTML/JavaScript to be stored in the tools database, which is then executed in the browsers of users when they view content containing the infected objects, leading to account takeover or code execution.
A stored cross-site scripting vulnerability has been identified in Tactical RMM version 1.5.2. This issue arises from inadequate input validation and output encoding in several fields, allowing HTML and JavaScript to be saved in the database. When users, particularly those with administrative privileges, view content containing the injected scripts, the malicious code executes in their browsers. This vulnerability can lead to account takeover by exfiltrating the victim's authorization token, which an attacker can use to impersonate the victim and access their account.
Users can update to Tactical RMM version 0.101.65, which addresses the vulnerability by improving input validation and output encoding to prevent the injection of malicious scripts.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Kuri119/Stored-XSS-In-Tactical-RMM-1.5.2/tree/main | CISA-ADP | ExploitTechnical Description |
| https://github.com/amidaware/tacticalrmm-web/commit/ba5363ea99cf776511e5c828b6d744e4d0bddd08 | [email protected] | Source CodeVendor |
| https://github.com/Kuri119/Stored-XSS-In-Tactical-RMM-1.5.2/tree/main | [email protected] | ExploitTechnical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Tactical RMM | 1.5.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2026 | New CVE Received | [email protected] |