CVE-2026-92375

HighCVSS 7.8/10Last modified Nov 4, 2026

Description

An improper access control vulnerability in the IPC communication between TeamViewer Full Client or Host prior to version 15.83 and the Remote Management Monitoring component prior to version 26.10.1 allows a local authenticated attacker with low privileges to execute scripts as SYSTEM/root.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
TeamViewer	Full Client	< 15.83; >= 15.64.0 (Legacy Windows 7 & 8), < 15.64.10 (Legacy Windows 7 & 8); >= 14.7.0 (Windows), < 14.7.48868 (Windows); >= 14.7.0 (Linux), < 14.7.48868 (Linux); >= 14.7.0 (macOS), < 14.7.48868 (macOS); >= 13.2.0 (Windows), < 13.2.36231 (Windows); >= 13.2.0 (Linux), < 13.2.154008 (Linux); >= 13.2.0 (macOS), < 13.2.154007 (macOS)
TeamViewer	Host	< 15.83; >= 15.64.0 (Legacy Windows 7 & 8), < 15.64.10 (Legacy Windows 7 & 8); >= 14.7.0 (Windows), < 14.7.48868 (Windows); >= 14.7.0 (Linux), < 14.7.48868 (Linux); >= 14.7.0 (macOS), < 14.7.48868 (macOS); >= 13.2.0 (Windows), < 13.2.36231 (Windows); >= 13.2.0 (Linux), < 13.2.154008 (Linux); >= 13.2.0 (macOS), < 13.2.154007 (macOS)
TeamViewer	Remote Management - Monitoring	< 26.10.1

References

https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1012/

Timeline

Published: Oct 27, 2026
Last modified: Nov 4, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-923767.8Improper authentication in the inter-process communication (IPC) mechanism of TeamViewer Remote Management Monitoring for Windows prior to v CVE-2026-923777.8Improper access control in the Patch Management update mechanism of TeamViewer Full Client and Host for Windows prior to version 15.82 allow CVE-2026-923784.1A session management vulnerability exists in the Legacy UI Reduced Function Login feature of NT-ware uniFLOW Online. Under specific timing c CVE-2026-923795.4An improper neutralization of input during web page generation vulnerability in the Notification API in Synology DiskStation Manager (DSM) b CVE-2026-923807.3A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment CVE-2026-923813.5A weakness has been identified in PbootCMS up to 3.2.22. This affects the function decode_string of the file apps/admin/controller/content/C CVE-2026-923824.1An out-of-bounds write flaw was found in usbredir. Starting an isochronous OUT stream with a transfer count of 1 leaves the stream's single CVE-2026-923834.3A security vulnerability has been detected in PbootCMS up to 3.2.24. This vulnerability affects the function UserController::del/UserControl CVE-2026-923852.4A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file /a CVE-2026-923868.1When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its lin CVE-2026-923878.1By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypa CVE-2026-923889.1When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback se