CVE-2026-111583

HighCVSS 7.3/10Last modified Nov 4, 2026

Description

Improper access control in the installer staging directory used by TeamViewer Full Client and Host prior to version 15.82 for Windows during installation of Advanced Asset Management allows a local authenticated user with low privileges to execute arbitrary commands as SYSTEM. An attacker can place a crafted installer options file that is processed by the Advanced Asset Management installer during service activation.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
TeamViewer	Full Client	< 15.82; >= 15.64.0 (Legacy windows 7 & 8), < 15.64.10 (Legacy windows 7 & 8)
TeamViewer	Host	< 15.82; >= 15.64.0 (Legacy Windows 7 & 8), < 15.64.10 (Legacy Windows 7 & 8)

References

https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1012/

Timeline

Published: Oct 27, 2026
Last modified: Nov 4, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1115847.3A race condition in the installation process of TeamViewer Remote Management - Patch Management for Windows prior to version 26.9.1 allows a CVE-2026-1115858.8An integer overflow in the remote-control screen processing component of TeamViewer clients (Full Client, Portable and Remote Control App) p CVE-2026-111594.3Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML pag CVE-2026-111590A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, al CVE-2026-1115926.4The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored C CVE-2026-1115948.1InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use tha CVE-2026-1115965.3The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify that a visitor holds an order's key before outputting that or CVE-2026-1115975.3The Forminator Forms WordPress plugin before 1.58.4 does not verify that a Stripe Checkout payment has completed before returning a pending CVE-2026-11166.1A Cross-site Scripting (XSS) vulnerability was identified in the `from_dict` method of the `AppLollmsMessage` class in parisneo/lollms prior CVE-2026-111606.5Out of bounds read in Input in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive infor CVE-2026-1116016.1The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'token_id' parameter in a CVE-2026-1116023.7The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information