TeamViewer Security Update Fixes Five High-Severity Flaws

TeamViewer has urged customers to update its remote access software after fixing five high-severity vulnerabilities. The TeamViewer security update addresses weaknesses that could allow unauthorized actions, code execution or elevated privileges.

The flaws affect TeamViewer Full Client, Host and related services. However, the company says it has found no evidence of active exploitation or publicly available exploit code.

Remote Session Flaw Poses the Greatest Risk

The most severe vulnerability, CVE-2026-92370, involves improper access controls in remote sessions. It affects Full Client and Host on Windows, Linux and macOS.

An attacker could exploit this weakness to perform actions outside the permissions of a remote session. In turn, those unauthorized actions could lead to remote code execution on the affected computer.

Because the flaw concerns session permissions, it creates risks beyond the access that a user intends to grant.

Four Additional Vulnerabilities Expand the Risk

Meanwhile, TeamViewer also addressed four other security weaknesses:

• CVE-2026-19743: A path traversal vulnerability.
• CVE-2026-92368: A heap-based buffer overflow.
• CVE-2026-92369: A time-of-check time-of-use race condition.
• CVE-2026-92371: An improper path validation vulnerability.

These flaws have different effects and attack requirements. Depending on the vulnerability, attackers could execute code with the current user’s permissions or gain higher privileges.

In some cases, those privileges could reach SYSTEM on Windows or root on Linux and macOS. As a result, successful exploitation could give an attacker extensive control over an affected system.

Version 15.82 Includes the Fixes

TeamViewer says version 15.82 resolves the vulnerabilities. In addition, the company has provided fixes through supported maintenance and legacy releases.

Customers should therefore install the latest available release for their supported software branch. The company recommends applying the TeamViewer security update as soon as possible.

Although TeamViewer reports no known exploitation, that finding does not remove the underlying security risks. Prompt patching closes the weaknesses before attackers can potentially use them.

Malicious Use Does Not Establish Exploitation

Separately, criminals have used legitimate remote access software, including TeamViewer, to enter victims’ systems and deploy malware.

However, that history does not show that attackers have exploited these five vulnerabilities. TeamViewer’s advisory describes security flaws and available fixes, without reporting attacks that use them.