CVE-2026-111584

HighCVSS 7.3/10Last modified Nov 4, 2026

Description

A race condition in the installation process of TeamViewer Remote Management - Patch Management for Windows prior to version 26.9.1 allows a local authenticated attacker with low privileges to execute arbitrary code with elevated privileges by replacing the service executable in an insufficiently protected temporary directory during Patch Management activation.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
TeamViewer	TeamViewer Remote - Patch Management	< 26.9.1; >= 0 (Legacy version for v14.7 client), < 24.12.5 (Legacy version for v14.7 client)

References

https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1012/

Timeline

Published: Oct 27, 2026
Last modified: Nov 4, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1115858.8An integer overflow in the remote-control screen processing component of TeamViewer clients (Full Client, Portable and Remote Control App) p CVE-2026-111594.3Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML pag CVE-2026-111590A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, al CVE-2026-1115926.4The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored C CVE-2026-1115948.1InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use tha CVE-2026-1115965.3The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify that a visitor holds an order's key before outputting that or CVE-2026-1115975.3The Forminator Forms WordPress plugin before 1.58.4 does not verify that a Stripe Checkout payment has completed before returning a pending CVE-2026-11166.1A Cross-site Scripting (XSS) vulnerability was identified in the `from_dict` method of the `AppLollmsMessage` class in parisneo/lollms prior CVE-2026-111606.5Out of bounds read in Input in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive infor CVE-2026-1116016.1The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'token_id' parameter in a CVE-2026-1116023.7The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information CVE-2026-1116034.3PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated students to access depa