Tactical RMM vulnerabilities

2 known vulnerabilities in Tactical RMM from AmidaWare. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  Tactical RMM: External Control of File Name or Path

  CVE-2026-129165Nov 13, 2026AmidaWare

  Tactical RMM 0.17.0 through 1.6.1 contains an arbitrary file read in the /reporting/templates/preview/ endpoint because WeasyPrint resolves file:// links in user-supplied template_md and embeds the files in the returned PDF. Users with report management permis

• 8.8 High severity

  Tactical Rmm: Improper Neutralization of Special Elements Used in a Template Engine

  CVE-2025-69516Jan 29, 2026AmidaWareEPSS 2.28%

  A Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactical RMM, affecting versions equal to or earlier than v1.3.1, allows low-privileged users with Report Viewer or Report Manager permissions to a