TeamViewer has issued an urgent call for customers to apply security updates addressing a cluster of high-severity vulnerabilities in its client and host software, announced on Tuesday.
The most critical vulnerability, tracked as CVE-2026-92370, involves a remote session access control bypass caused by improper access control in TeamViewer Full Client and Host across Windows, Linux, and macOS. The flaw could permit remote attackers to execute unauthorized actions and achieve remote code execution on affected systems.
Four additional vulnerabilities were disclosed alongside the primary flaw: CVE-2026-19743 (path traversal), CVE-2026-92368 (heap-based buffer overflow), CVE-2026-92369 (time-of-check time-of-use race condition), and CVE-2026-92371 (improper path validation). These issues could allow local attackers to execute code remotely with current user privileges or escalate to NT AUTHORITY/SYSTEM or root access.
TeamViewer strongly recommends that all users update to the latest available version as soon as possible
TeamViewer
The company stated that it has not identified public exploit code or active exploitation of these vulnerabilities in the wild. TeamViewer version 15.82, along with supported maintenance and legacy releases, contains the necessary fixes.
These vulnerabilities have been resolved in TeamViewer Clients version 15.82 as well as supported maintenance and legacy releases. TeamViewer is not aware of any public disclosure or active exploitation in the wild.
TeamViewer
TeamViewer's remote access and desktop sharing capabilities have made it a popular tool, but the platform has also become a target for cybercriminals and ransomware operators seeking to infiltrate systems and deploy malicious payloads remotely.
The vendor has experienced multiple security incidents affecting its corporate infrastructure over the past decade. A 2016 breach involved Chinese threat actors deploying the Winnti backdoor, which was publicly disclosed in May 2019. A second incident compromised TeamViewer's internal network and was revealed two years ago, subsequently attributed to Russian state-backed group Midnight Blizzard, also known as APT29, Nobelium, or Cozy Bear.