TeamViewer urges users to patch severe flaws “as soon as possible”
TeamViewer urges immediate updates for five high-severity client and host flaws, including a remote code-execution bug.
TeamViewer warned customers to patch five high-severity vulnerabilities in Full Client and Host for Windows, Linux, and macOS as soon as possible. CVE-2026-92370 is an improper access-control flaw that could let remote attackers bypass session controls and reach remote code execution. CVE-2026-19743, CVE-2026-92368, CVE-2026-92369, and CVE-2026-92371 can allow local attackers to execute code as the current user or escalate to SYSTEM or root. The issues are fixed in version 15.82 and supported maintenance releases. TeamViewer said it is unaware of public exploit code or exploitation in the wild.
- CVE-2026-92370 can bypass remote-session controls and lead to code execution.
- Four other bugs allow local code execution or escalation to SYSTEM or root.
- Fixes are in TeamViewer 15.82 and supported maintenance releases.
- TeamViewer reports no public exploit and no active exploitation.
- Criminals have historically abused TeamViewer for remote access and malware.
- Vendors
- TeamViewer
- Threat actors
- Midnight Blizzard
- Malware
- Winnti
- Organizations
- TeamViewer
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-92370+2 related CVEs | Access Control Bypass in TeamViewer Full Client and Host Could Lead to RCE | 8.8 group max | — | ||
CVE-2026-92369+1 related CVE | TOCTOU privilege escalation in TeamViewer Windows installer | 7.3 group max | — |
From the original article
2 min read at bleepingcomputer.com
Remote access software company TeamViewer warned customers on Tuesday to immediately patch a set of high-severity vulnerabilities affecting its client and host software. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.