What is the CVSS score of CVE-2025-69516?

CVE-2025-69516 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 42.9%.

Is there a public PoC exploit available for CVE-2025-69516?

Yes, a public proof-of-concept exploit is available for CVE-2025-69516. Prioritise patching immediately. EPSS: 42.9%.

How to fix or mitigate CVE-2025-69516?

Within 24 hours: Audit all users with Report Viewer and Report Manager roles and document their business justification; restrict access to the /reporting/templates/preview/ endpoint via WAF or network controls. Within 7 days: Implement network segmentation to isolate RMM servers; deploy enhanced monitoring and logging on the reporting module; contact Amidaware for patch timeline and workaround guidance. Within 30 days: Execute upgrade to patched version once available; conduct forensic analysis for indicators of compromise; review RMM server logs for exploitation attempts.

Tactical Rmm CVE-2025-69516

HIGH

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2026-01-29 cve@mitre.org

Code Injection Tactical Rmm

8.8

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-1336 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V1 - Encoding and Sanitization Template injection prevention
Impact	CVSS 8.8 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: Low. User interaction: None. Exploitable via remote/network. EPSS: 42.9% probability of exploitation.
Exploit ScenarioDerived	A remote attacker could exploit this vulnerability to compromise the affected system.

Act Now Prioritize within 24-48h. Why: HIGH severity + EPSS > 10%.

No patch listed yet 42.9% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Affects Tactical Rmm. A Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactical RMM, affecting versions equal to or earlier than v1.3.1, allows low-privileged users with Report Viewer or Report Manager permissions to achieve remote command execution on the server. This occurs due to improper sanitization of the template_md parameter, enabling direct injection of Jinja2 templates. This occurs due to misuse of the generate_html() function, the user-control

Severity by source

NVD PRIMARY 8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

A Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactical RMM, affecting versions equal to or earlier than v1.3.1, allows low-privileged users with Report Viewer or Report Manager permissions to achieve remote command execution on the server. This occurs due to improper sanitization of the template_md parameter, enabling direct injection of Jinja2 templates. This occurs due to misuse of the generate_html() function, the user-controlled value is inserted into env.from_string, a function that processes Jinja2 templates arbitrarily, making an SSTI possible.

Executive ViewAI

Why It Matters

A critical vulnerability in Amidaware Tactical RMM allows users with report access permissions to execute arbitrary commands on the server, potentially compromising the entire remote management infrastructure. This poses an immediate risk to all organizations using v1.3.1 or earlier, as the threat has a 42.9% exploitation probability with no vendor patch currently available.

Business Impact: Severe

Compensating Controls

Implement Web Application Firewall (WAF) rules to block or rate-limit requests to /reporting/templates/preview/ endpoint; restrict network access to the RMM platform to trusted internal networks only; disable report template preview functionality if business operations permit; enforce multi-factor authentication for all Report Viewer and Report Manager role assignments; implement real-time alerting on template preview endpoint access; consider running RMM in a restricted network segment with egress filtering to limit command execution impact.

Threat Intelligence Overview

Threat Score

4.5/10

Composite threat intelligence

EPSS Score

42.9%

Top 3% exploitable

Exploit

POC

Public exploit code exists

Data Quality

5 sources

Confidence: Medium

NVD

CVE.org

EPSS POC (1)

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 42.9%

Patch available No

Active threat Yes

Deciding rule

HIGH severity + EPSS > 10%

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Immediate

Exploitation· derived

Active

System Exposure· derived

Open

Automatable· derived

Human Impact

Very High

Priority Score

122

Low Medium High Critical

KEV: 0

EPSS: +43

CVSS: +44

PoC: +20

Weaponized: +15

Threat intel: 0

Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.