[GH-ISSUE #70] Embedded Python 3.11.9 in Tactical RMM Agent flagged by CVE-2025-13836 #44

New issue

Closed

opened 2026-03-02 02:12:55 +03:00 by kerem · 1 comment

kerem commented

2026-03-02 02:12:55 +03:00

Owner

Originally created by @nbruneau71250 on GitHub (Jan 9, 2026).
Original GitHub issue: https://github.com/amidaware/rmmagent/issues/70

Hello,

While running vulnerability scans with Wazuh on Windows endpoints, we consistently get alerts for CVE-2025-13836 related to an embedded Python interpreter shipped with the Tactical RMM agent.

Details:

Path: C:\Program Files\TacticalAgent\python\py3.11.9_amd64\python.exe
Embedded Python version: 3.11.9
Scanner: Wazuh (OSSEC-based), signature-based detection

The system-wide Python has already been fully removed, and the alert clearly points to the Python bundled with the Tactical RMM agent.

It appears that Python 3.11.9 is affected by CVE-2025-13836, and updating or rebuilding the agent with a patched Python version would resolve the issue.

Could you please confirm:

Whether this embedded Python is expected to be updated in a future agent release
Or if there is already a version of the agent that ships with a patched Python runtime

This is not a critical breakage, but it does generate persistent security alerts in enterprise environments.

Thanks for your work on Tactical RMM.

Originally created by @nbruneau71250 on GitHub (Jan 9, 2026). Original GitHub issue: https://github.com/amidaware/rmmagent/issues/70 Hello, While running vulnerability scans with Wazuh on Windows endpoints, we consistently get alerts for CVE-2025-13836 related to an embedded Python interpreter shipped with the Tactical RMM agent. Details: - Path: C:\Program Files\TacticalAgent\python\py3.11.9_amd64\python.exe - Embedded Python version: 3.11.9 - Scanner: Wazuh (OSSEC-based), signature-based detection The system-wide Python has already been fully removed, and the alert clearly points to the Python bundled with the Tactical RMM agent. It appears that Python 3.11.9 is affected by CVE-2025-13836, and updating or rebuilding the agent with a patched Python version would resolve the issue. Could you please confirm: - Whether this embedded Python is expected to be updated in a future agent release - Or if there is already a version of the agent that ships with a patched Python runtime This is not a critical breakage, but it does generate persistent security alerts in enterprise environments. Thanks for your work on Tactical RMM.

kerem closed this issue

2026-03-02 02:12:55 +03:00

kerem commented

2026-03-02 02:12:55 +03:00

Author

Owner

@wh1te909 commented on GitHub (Jan 9, 2026):

it will be updated at a later time, you can safely ignore this, as it’s not relevant to how the agent operates.

@wh1te909 commented on GitHub (Jan 9, 2026): it will be updated at a later time, you can safely ignore this, as it’s not relevant to how the agent operates.

kerem referenced this issue

2026-03-02 02:13:00 +03:00

[PR #44] [MERGED] Add agent shutdown command #58