Surprisingly Useful AI Article Enhancements
TeamViewer has disclosed five security vulnerabilities in its Full Client and Host software, the two highest rated at 8.8 and 7.8 on the CVSS 3.1 scale.
The flaws, addressed in security bulletin TV-2026-1010, affect TeamViewer Remote, TeamViewer Tensor and TeamViewer ONE across Windows, Linux and macOS. All five were resolved in version 15.82 of the TeamViewer Clients, with matching fixes pushed to supported maintenance and legacy branches.
TeamViewer urged customers to update “as soon as possible” and indicated it had seen no evidence of public exploit code or active exploitation tied to any of the five CVEs.
The vulnerabilities sit inside software that grants one machine deep, often privileged control over another – the core function of any remote-access tool, and the same capability an attacker would seek to abuse.
The headline flaw: CVE-2026-92370
The highest-rated vulnerability, CVE-2026-92370, is an improper access-control flaw carrying a CVSS score of 8.8. It affects TeamViewer Full Client, Host and related modules across Windows, Linux and macOS.
According to the National Vulnerability Database advisory, an authenticated remote attacker already inside a session can bypass permission settings the device owner explicitly configured, performing actions the victim had denied.
TeamViewer warned that the flaw could lead to unauthorised activity and potentially remote code execution on the affected endpoint. Some press coverage has characterised the practical impact as a path toward remote code execution once those denied permissions are bypassed, though the underlying weakness is the access-control failure itself.
All Full Client and Host versions before 15.82 are affected, along with vulnerable legacy releases in the 15.64, 14.7 and 13.2 branches.
Local privilege escalation via path traversal
CVE-2026-19743 is a local privilege-escalation bug rated 7.8, residing in the local inter-process communication service that TeamViewer’s client and host components use to communicate on the same machine.
The NVD record describes improper path validation that lets a low-privileged, already-authenticated local user write arbitrary files with elevated rights, reaching NT AUTHORITY\SYSTEM on Windows or root on Linux and macOS.
It is classified as CWE-22, commonly known as path traversal. A low-privileged local authenticated attacker can send crafted IPC commands to the TeamViewer service daemon, allowing them to manipulate file paths.
The flaw is meaningful on shared or multi-user machines – call centres, lab kiosks and shared workstations – but requires local access first, which narrows the realistic attack surface compared to a network-facing vulnerability.
Heap buffer overflow in session recordings
CVE-2026-92368, also rated 7.8, is a heap-based buffer overflow triggered when TeamViewer’s “Play or convert recorded session” feature processes a malicious .tvs session-recording file.
A size mismatch during decompression of recorded session data can cause an out-of-bounds heap write. A specially crafted recording could execute code with the privileges of whoever opens it.
This is a classic file-format attack vector: convince a support technician or IT administrator to open a recording they believe came from a legitimate session, and the payload runs the moment it decompresses.
Related: Best Business Laptops for work & school
Related: Best Gaming Laptops
Related: Best Portable Laptop
According to the GitHub Security Advisory tracking the issue, the vulnerability affects TeamViewer Full Client and Host versions on Linux and macOS from 15.70 up to, but not including, 15.82.
Installer rollback and cloud recording flaws
CVE-2026-92369, rated 7.3, is a time-of-check time-of-use (TOCTOU) race condition in the TeamViewer Windows installer rollback mechanism.
During an installation or update rollback, the installer stores backup files in a user-writable temporary directory before an elevated installer process restores them. A local low-privileged attacker who successfully exploits the race condition may replace these files, allowing the elevated process to restore attacker-controlled content, which could lead to privilege escalation to NT AUTHORITY\SYSTEM.
CVE-2026-92371, rated 7.0, impacts the Cloud Session Recording function on Linux. The flaw involves improper link resolution and a race condition between path validation and file access. A local authenticated attacker could exploit this condition to redirect privileged file operations to unintended locations.
Complex patch matrix spans four release branches
TeamViewer’s fix matrix covers more branches than a single “update to the latest version” instruction suggests, because the company still supports several legacy release trains for customers running older operating systems.
The current branch, versions 15.0 up to but not including 15.82, moves to 15.82. A legacy branch built for Windows 7 and 8, spanning 15.64.0 up to 15.64.8, gets its own patched build at 15.64.8. Two older branches covering version 14 on Windows and Linux, running from 14.7.0 up to 14.7.48855, are fixed at 14.7.48855. A still-older Windows branch on the 13.2 line, from 13.2.0 up to 13.2.36230, is fixed at 13.2.36230.
That spread creates a real operational challenge. An organisation running TeamViewer across a mixed fleet – some newer Windows 11 machines, some ageing point-of-sale terminals still on Windows 7 – cannot simply push one installer and consider it done.
IT teams need to identify exactly which branch each endpoint runs before patching. Grabbing the generic 15.82 installer will not touch a machine still locked to the 13.2 or 14.7 legacy line.
No active exploitation, but a short window to patch
TeamViewer’s bulletin and early press coverage agree that there is no evidence of publicly available exploit code or active exploitation tied to any of the five CVEs.
That is a different risk posture from, for example, the Citrix NetScaler or Cisco SD-WAN flaws that the US Cybersecurity and Infrastructure Security Agency (CISA) added to its Known Exploited Vulnerabilities catalogue in the same period, both of which were already being used in the wild before the public warning went out.
However, “no evidence yet” has a short shelf life once a CVSS 8.8 bug with public technical detail is sitting in NVD and GitHub Security Advisories. Security researchers routinely reverse-engineer patches within days of release, a technique known as patch diffing, to reconstruct the exact code change and work backward to a proof of concept.
For a tool installed across hundreds of thousands of help-desk, IT support and remote-work machines, the incentive to build that proof of concept is high, and the published advisories already describe the vulnerable code paths in enough detail to narrow the search.
Why remote-access software draws persistent scrutiny
Remote-desktop tools occupy an unusual spot in the security stack. They are designed to grant one machine deep control over another, which is the entire point of the product, and the same capability an attacker wants.
That dual nature is why TeamViewer, AnyDesk, Splashtop, ConnectWise ScreenConnect and similar tools have all drawn security research attention over the past several years.
It also explains why ransomware crews and scam operators have repeatedly abused legitimate remote-access software rather than building custom malware from scratch. A tech-support scam that talks a victim into installing TeamViewer, or a ransomware affiliate that finds ConnectWise ScreenConnect already deployed on a compromised network, gets the same level of access a real IT administrator would have, without tripping antivirus signatures tuned to detect unfamiliar executables.
How this differs from TeamViewer’s past security events
TeamViewer’s history includes a widely discussed 2016 wave of account-takeover complaints, which the company attributed to credential reuse from unrelated third-party breaches rather than a flaw in its own software.
A 2024 corporate network intrusion tied to the APT29 threat group was, according to TeamViewer, confined to its internal IT environment and did not touch the product or customer data.
TV-2026-1010 is a different category of event: a vendor-disclosed, coordinated set of product vulnerabilities with CVE identifiers, NVD entries and a shipped fix. The three categories – account-takeover from reused passwords, a breach of the vendor’s corporate network, and a flaw in the shipped software – get conflated in headlines, but only the third requires an actual software patch.
A crowded patch week compounds the risk
The disclosure did not land in isolation. The same period saw Microsoft’s September Patch Tuesday address two actively exploited zero-days and 113 vulnerabilities, Oracle’s Critical Patch Update cover more than 800 flaws across 17 product families, ISC ship BIND 9 fixes for 14 vulnerabilities including seven rated high severity, and CISA add Citrix NetScaler and Cisco Catalyst SD-WAN Manager bugs to its Known Exploited Vulnerabilities catalogue after confirming in-the-wild attacks.
Security teams working through that backlog have a limited number of patch windows. Remote-access software, despite running on what amounts to every support desk in the world, often loses the prioritisation fight against vendor-labelled “critical, actively exploited” tags elsewhere on the list.
TeamViewer rated its own worst bug “Important” rather than “Critical,” and confirmed no active exploitation – two factors that will push TV-2026-1010 lower on most triage lists this cycle. But the installed base for remote-access software is large and largely invisible to central IT, since so much of it gets installed ad hoc by individual employees or support technicians rather than through managed software deployment.
A bug that is easy to deprioritise on paper can still represent the single largest patch gap in an organisation’s actual environment, simply because nobody tracked where all the installs live.
What organisations should do now
The practical response breaks into three tiers.
First, inventory: identify every endpoint running TeamViewer Full Client or Host, and tag which version branch each one is on, since the 15.x, 15.64.x, 14.7.x and 13.2.x lines all need different installers.
Second, patch: push 15.82 or the matching legacy fix to every machine identified, prioritising internet-facing support desks and any system where TeamViewer sessions cross organisational boundaries, since CVE-2026-92370’s access-control bypass is specifically a remote-session issue.
Third, harden: disable or restrict the “Play or convert recorded session” feature where business workflows allow it, since that is the specific feature path tied to CVE-2026-92368, and train support staff not to open session recordings from unverified sources.
Security teams should also review TeamViewer access-control settings, limit remote-access privileges, restrict local access to managed endpoints and monitor for unusual installer activity, suspicious session-recording files or unexpected changes to protected system files.
Organisations running TeamViewer Tensor in a managed enterprise rollout have an advantage: centralised policy push means a single admin action can force the update across the fleet, rather than relying on individual end users to click through an update prompt.
Shops still running the free or single-licence version of TeamViewer, common in small businesses and home-office setups, carry more exposure simply because there is no central IT function forcing the update.
Small businesses face outsized risk
Organisations without dedicated IT staff or centralised patch management are the most likely to still be running an unpatched version weeks or months from now, since there is no IT policy forcing the 15.82 update across every installed copy.
Prior tech-support-scam abuse of TeamViewer specifically targeted exactly that less-managed user base.
Remote-access software became permanent infrastructure during the shift to hybrid and remote work, and it has not gotten less central since. Help desks, managed service providers, embedded-systems technicians and consumer tech support all rely on tools like TeamViewer daily.
A CVSS 8.8 bug in that category, even one with no confirmed in-the-wild exploitation, warrants the same patch-window priority as a flaw in a more visible piece of infrastructure.
Whether the long tail of unmanaged, home-office and small-business installs actually gets the 15.82 update before a working exploit surfaces is the part nobody can fully verify from the outside.
Last Updated on October 3, 2026 by Nick Ross
