PT-2026-5133 · Amidaware · Tactical Rmm

Published 2026-01-28 · Updated 2026-01-30 · CVE-2025-69517

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Amidaware Inc Tactical RMM versions 1.3.1 and earlier

Description An HTML injection issue in Tactical RMM allows authenticated users to inject arbitrary HTML content when creating a new agent via the /api/v3/newagent/ API endpoint. The agent id parameter, which accepts up to 255 characters, is not properly sanitized using DOMPurify.sanitize() with the html: true option, resulting in inadequate filtering of HTML input. This injected HTML is rendered within the Tactical RMM management panel when an administrator attempts to remove or shut down the affected agent, potentially enabling client-side attacks like UI manipulation or phishing. The DOMPurify.sanitize() function is used for sanitization.

Recommendations Versions prior to 1.3.1 should be updated.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-69517

Affected Products

Tactical Rmm

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-69517 · Security Note
• https://osv.dev/vulnerability/CVE-2025-69517 · Vendor Advisory
• https://github.com/amidaware/tacticalrmm · Note
• https://gist.github.com/NtGabrielGomes/fdabcd9e85d841c5490739686e0f8b72 · Note
• https://t.me/cveNotify/150340 · Telegram Post
• https://twitter.com/CVEnew/status/2016541927706124341 · Twitter Post
• https://amidaware.com · Note
• https://twitter.com/bbwriteups/status/2016926974284091889 · Twitter Post
• https://twitter.com/SNISS8/status/2017051341961453785 · Twitter Post
• https://twitter.com/TheHackerWire/status/2016919527561580641 · Twitter Post