Remote Support and Privileged Remote Access
CVE-2025-5309: Remote Support & Privileged Remote Access server side template injection
The chat feature within Remote Support (RS) and Privileged Remote Access (PRA) is vulnerable to a Server-Side Template Injection vulnerability which can lead to remote code execution.
Published
ExploitedNot in CISA KEV
Ransomware useNot reportedPer CISA
SeverityHIGHCVSS 4.0 8.6
EPSS0.95%Chance of exploitation in 30 days
Public exploitNot tracked
FixSee advisory
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Remote support & Privileged Remote Access 24.2.2 to 24.2.4 | Upgrade past 24.2.4; see the advisory |
| Remote support & Privileged Remote Access 24.3.1 to 24.3.3 | Upgrade past 24.3.3; see the advisory |
| Remote support & Privileged Remote Access 25.1 | See the advisory |
| Remote Support(RS) & Privileged Remote Access(PRA) 24.2.2 to 24.2.4 | Upgrade past 24.2.4; see the advisory |
| Remote Support(RS) & Privileged Remote Access(PRA) 24.3.1 to 24.3.4 | Upgrade past 24.3.4; see the advisory |
| Remote Support(RS) & Privileged Remote Access(PRA) 25.1 | See the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
The chat feature within Remote Support (RS) and Privileged Remote Access (PRA) is vulnerable to a Server-Side Template Injection vulnerability which can lead to remote code execution.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.