---
id: "CVE-2026-121578"
kind: "vulnerability"
aliases: ["CVE-2026-121578"]
title: "Tactical RMM: stored XSS in tools database runs script in viewers' browsers"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["msp", "runtime", "self-hosted", "tactical-rmm"]
not_affected_if: ["not-running-tactical-rmm"]
published_at: "2026-11-03T16:17:29+00:00"
first_seen_at: "2026-11-03T16:21:45+00:00"
updated_at: "2026-11-03T16:24:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121578", "first_seen_at": "2026-11-03T16:21:45+00:00"}]
---

# Tactical RMM: stored XSS in tools database runs script in viewers' browsers

Tactical RMM does not validate or encode certain fields, so HTML and JavaScript can be saved to the tools database. That code runs in the browser of any user who views the affected objects, enabling account takeover or code execution in the browser.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether you run Tactical RMM and which version is installed
- Review the tools database for stored objects containing HTML or script tags

## Timeline

- 2026-11-03T16:21:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121578

## Documents

- [fix] Patch: github.com https://github.com/amidaware/tacticalrmm-web/commit/ba5363ea99cf776511e5c828b6d744e4d0bddd08

## From the sources

Tactical RMM contains a stored XSS vulnerability caused by improperly validated input or encode output for various fields, enabling HTML/JavaScript to be stored in the tools database, which is then executed in the browsers of users when they view content containing the infected objects, leading to account takeover or code execution.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_