CVE-2026-121578: XSS

Published Nov 3, 2026

Updated

Tactical RMM contains a stored XSS vulnerability caused by improperly validated input or encode output for various fields, enabling HTML/JavaScript to be stored in the tools database, which is then executed in the browsers of users when they view content containing the infected objects, leading to account takeover or code execution.

Event History

Nov 3, 2026

CVE Published

via MITRE·03:33 PM

Data Sourced

via MITRE·03:33 PM

DescriptionWeakness

Data Sourced

via OSV·03:33 PM

DescriptionSeverity

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this vulnerability?

Users who view Tactical RMM content containing infected objects are exposed, because stored HTML or JavaScript executes in their browsers. Successful exploitation can lead to account takeover or code execution in the affected user's browser context.

What does an attacker need to exploit it?

An attacker needs a way to submit malicious input into one of the affected fields so that HTML or JavaScript is stored in the tools database. A user must then view content containing the stored malicious object.

Is user interaction required?

Yes. The affected user must view content that contains an infected object for the stored script to execute in their browser.

CVE-2026-121578: XSS

Event History

Frequently Asked Questions

Who is exposed to this vulnerability?

What does an attacker need to exploit it?

Is user interaction required?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this vulnerability?

What does an attacker need to exploit it?

Is user interaction required?