CVE-2025-69517

HighRCE

Published: 28 January 2026

Published

28 January 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0046 36.4th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2025-69517 is a high-severity Code Injection (CWE-94) vulnerability in Amidaware Inc Tactical (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Internal Spearphishing (T1534); ranked at the 36.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2025-69517 is an HTML injection vulnerability affecting Amidaware Inc's Tactical RMM software in version 1.3.1 and earlier. The issue arises in the POST /api/v3/newagent/ endpoint, where the agent_id parameter accepts up to 255 characters but is improperly sanitized using DOMPurify.sanitize() with the html: true option enabled. This inadequate filtering allows authenticated users to inject arbitrary HTML content, which is later rendered in the Tactical RMM management panel. The vulnerability is rated with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-94 (Improper Control of Generation of Code).

Authenticated users with low privileges can exploit this vulnerability by supplying malicious HTML in the agent_id field during agent creation. When an administrator interacts with the affected agent—such as attempting to remove or shut it down—the injected HTML is rendered in the management panel, enabling client-side attacks like UI manipulation or phishing against the administrator.

References include a GitHub Gist likely detailing the issue, the official Tactical RMM repository, and the vendor's website. The CVE description notes the supplier's position that the provided information is incorrect, with no specific patch or mitigation details outlined in the available data.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-206495

Vulnerability details

An HTML injection vulnerability in Amidaware Inc Tactical RMM v1.3.1 and earlier allows authenticated users to inject arbitrary HTML content during the creation of a new agent via the POST /api/v3/newagent/ endpoint. The agent_id parameter accepts up to 255 characters…

and is improperly sanitized using DOMPurify.sanitize() with the html: true option enabled, which fails to adequately filter HTML input. The injected HTML is rendered in the Tactical RMM management panel when an administrator attempts to remove or shut down the affected agent, potentially leading to client-side attacks such as UI manipulation or phishing. NOTE: the Supplier's position is that this has incorrect information.

CWE(s): CWE-94

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1534 Internal Spearphishing Lateral Movement

After they already have access to accounts or systems within the environment, adversaries may use internal spearphishing to gain access to additional information or compromise other users within the same organization.

attack.mitre.org →

Why these techniques?

HTML injection enables internal spearphishing via rendered malicious content in admin UI.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0