CVE-2026-92370

An improper access control flaw (CWE-284) in TeamViewer Full Client, TeamViewer Host, and related affected modules on Windows, Linux, and macOS lets a remote attacker override the victim's own permission settings during session establishment. The CVSS 3.1 vector (8.8, AV:N/PR:N/UI:R) indicates the attack requires no prior privileges but does require user interaction — in practice, a session being accepted or established with the target — after which the attacker can modify access-control parameters to perform actions that were explicitly denied in the victim's configuration (such as restricted remote-control or file-transfer features). Successful abuse gives the attacker unauthorized capabilities within the session, which the advisory warns may escalate to remote code execution on the target system. Anyone running affected builds of TeamViewer's desktop client or Host across the three platforms is exposed, with unattended-access deployments at greatest risk. No public proof of concept is known and the flaw is not in CISA's KEV catalog, so exploitation is currently assessed as none known.

What to do: Update TeamViewer Full Client, Host, and related modules to the fixed releases named in TeamViewer's security bulletin (the advisory data here lists no specific version numbers, so pull the latest build and verify against the vendor's advisory). Until patched, tighten incoming connections — restrict to partner whitelists, enforce strong unattended-access passwords, and disable easy access — and instruct users to reject unexpected session prompts, since the attack depends on a session being established with user interaction. Afterwards, review TeamViewer connection logs for sessions in which features the configuration had denied (e.g., file transfer or remote control) were nonetheless used.