TeamViewer urges users to patch severe flaws as soon as possible

TeamViewer, the company behind the popular remote access software, warned customers on Tuesday to immediately patch a set of high-severity vulnerabilities. The flaws affect both its client and host software.

Five vulnerabilities

The most serious of them is a remote session access control bypass (CVE-2026-92370). It stems from an improper access control weakness in TeamViewer Full Client and Host for Windows, Linux, and macOS, and could let remote attackers perform unauthorized actions leading to remote code execution on targeted systems.

The remaining four issues are a path traversal (CVE-2026-19743), a heap-based buffer overflow (CVE-2026-92368), a time-of-check time-of-use (TOCTOU) race condition (CVE-2026-92369), and an improper path validation (CVE-2026-92371). They let local attackers gain code execution with the privileges of the current user, or escalate privileges to NT AUTHORITY/SYSTEM or root.

Update to version 15.82

"TeamViewer strongly recommends that all users update to the latest available version as soon as possible," the company said in an advisory that is rare for it. The fixes ship in TeamViewer Clients version 15.82, as well as in supported maintenance and legacy releases.

The company stressed that it has found no evidence of publicly available exploit code, public disclosure, or active exploitation of these flaws in the wild.

A tempting target

TeamViewer's simplicity and capabilities are valued by users — but the same qualities appeal to cybercriminals, including ransomware gangs, who abuse the tool to reach victims' systems remotely and deploy malware.

Over the past decade, TeamViewer has also disclosed several breaches of its own corporate network. The first, revealed in May 2019, was tied to Chinese threat actors wielding the Winnti backdoor. The second, disclosed two years ago, hit the company's internal corporate network; days later it was linked to the Russian state-backed group Midnight Blizzard, also known as APT29, Nobelium, or Cozy Bear.

Source: Bleeping Computer