Live › vulnerability › CVE-2026-121578
Tactical RMM does not validate or encode certain fields, so HTML and JavaScript can be saved to the tools database. That code runs in the browser of any user who views the affected objects, enabling account takeover or code execution in the browser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 16:21 UTC. All times on this page are UTC.
Teams that self-host Tactical RMM and let users create or view tools or other stored content in its web interface are exposed. Sources do not state which versions are affected or any non-default setting required. Deployments that do not run Tactical RMM can skip it.
No product ranges from the sources yet.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Tactical RMM contains a stored XSS vulnerability caused by improperly validated input or encode output for various fields, enabling HTML/JavaScript to be stored in the tools database, which is then executed in the browsers of users when they view content containing the infected objects, leading to account takeover or code execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-121578")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.