Tactical RMM EUVD-2026-116009

Exploitation requires the ability to write to the affected fields - automated-task and schedule option labels and TacticalDropdown options that were rendered with Vue's v-html - which in Tactical RMM's web console requires an authenticated session, plus a victim user (typically an administrator) subsequently viewing the page that displays the stored payload (user interaction required). Limiting factors: affected only in versions ≤1.6.2, remediated by commit ba5363e; the attack is not automatable (SSVC Automatable: no) and impact is partial. The precise list of injectable fields and whether any unauthenticated or agent-supplied input reaches these labels is not described in the available sources.

This is a medium-severity stored XSS (NVD CVSS 6.1; CWE-79) and the signals point to a real-but-not-urgent issue rather than a top-priority emergency. The vuln.today Decision label is this_month, and CISA's SSVC framework classifies it as Exploitation: poc, Automatable: no, Technical Impact: partial - consistent with a bug that needs a victim to view attacker-controlled content and cannot be mass-automated. A public PoC reference exists for version 1.5.2 (Kuri119 GitHub repo); it is not verified as working exploit code. There is no KEV listing and no EPSS score was supplied, so there is no evidence of active exploitation - exploitation status is best described as a public PoC reference existing, not confirmed in-the-wild use. One conflict to verify: the supplied CVSS vector uses PR:N (unauthenticated), but this is a stored XSS in fields of an authenticated RMM management console (automated-task/schedule/dropdown option labels rendered via Vue v-html), which realistically requires an authenticated account to store the payload - so the true attacker privilege is more likely PR:L. The S:C (scope change) and partial C/I are appropriate because the payload executes in a victim's browser session, which in an RMM context can escalate to account takeover and, through RMM's remote-scripting capability, code execution on managed endpoints - the basis for the input's 'code execution' wording and RCE tag.

An authenticated Tactical RMM user injects a JavaScript payload into a vulnerable field - such as an automated-task, schedule, or dropdown option label that the web UI renders with Vue's v-html - so the payload is stored in the database. When another user, typically an administrator, opens the page that displays the stored object, the script executes in their session, enabling account takeover and potentially remote script execution on managed endpoints. A public PoC reference exists for 1.5.2 but is not verified as working exploit code.