Multiple TeamViewer Vulnerabilities Enable RCE, Access Control Bypass and Privilege Escalation
TeamViewer patched five high-severity flaws enabling RCE, access-control bypass, and privilege escalation.
TeamViewer bulletin TV-2026-1010 fixes five high-severity flaws in Full Client and Host on Windows, Linux, and macOS. CVE-2026-92370, scored CVSS 8.8, lets an authenticated remote attacker bypass session restrictions and potentially run code. The other issues are path-traversal file writes (CVE-2026-19743), malicious .tvs recording RCE (CVE-2026-92368), an installer rollback race (CVE-2026-92369), and Linux cloud-recording privilege escalation (CVE-2026-92371). Organizations should deploy 15.82 or the listed legacy maintenance updates.
- CVE-2026-92370 scores CVSS 8.8 and can lead to remote code execution.
- Path traversal and an installer race can yield SYSTEM or root privileges.
- Malicious .tvs recordings can trigger heap-overflow RCE on Linux and macOS.
- Mainline fix is 15.82; legacy 15.64, 14.7, and 13.2 branches also need patches.
- Vendors
- TeamViewer
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-92370+2 related CVEs | Access Control Bypass in TeamViewer Full Client and Host Could Lead to RCE | 8.8 group max | — | ||
CVE-2026-92369+1 related CVE | TOCTOU privilege escalation in TeamViewer Windows installer | 7.3 group max | — |
From the original article
3 min read at gbhackers.com
TeamViewer has issued security bulletin TV-2026-1010 to address five high-severity vulnerabilities found in the TeamViewer Full Client, Host, and related services. These vulnerabilities affect deployments on Windows, Linux, and macOS, and include issues such as remote code execution, session permission bypass, arbitrary privileged file writes, and local privilege escalation.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.