CVE-2026-92370

Remote Session Access Control Bypass Leading to Remote Code Execution

State: Published
Severity: 8.8 High
Published: Sep 29, 2026
Updated: Sep 30, 2026
Reserved: Sep 16, 2026

Description

An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. By modifying access control parameters for restricted features, an attacker can perform actions that were explicitly denied by the victim's configuration. This may result in unauthorized actions and potentially lead to remote code execution on the target system.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	TV

Weaknesses

CWE-284 Improper Access Control

Affected Products

Product	Versions
Full ClientTeamViewer	15.0 to before 15.82Affected 15.64.0 (Legacy Windows 7 & 8) to before 15.64.8 (Legacy Windows 7 & 8)Affected 14.7.0 (Windows) to before 14.7.48855 (Windows)Affected 13.2.0 (Windows) to before 13.2.36230 (Windows)Affected 14.7.0 (Linux) to before 14.7.48855 (Linux)Affected 13.2.0 (Linux) to before 13.2.153995 (Linux)Affected 14.7.0 (MacOS) to before 14.7.48855 (MacOS)Affected 13.2.0 (MacOS) to before 13.2.153994 (MacOS)Affected
HostTeamViewer	15.0 to before 15.82Affected 15.64.0 (Legacy Windows 7 & 8) to before 15.64.8 (Legacy Windows 7 & 8)Affected 14.7.0 (Windows) to before 14.7.48855 (Windows)Affected 13.2.0 (Windows) to before 13.2.36230 (Windows)Affected 14.7.0 (Linux) to before 14.7.48855 (Linux)Affected 13.2.0 (Linux) to before 13.2.153995 (Linux)Affected 14.7.0 (MacOS) to before 14.7.48855 (MacOS)Affected 13.2.0 (MacOS) to before 13.2.153994 (MacOS)Affected

Product

Versions

Full ClientTeamViewer

15.0 to before 15.82Affected
15.64.0 (Legacy Windows 7 & 8) to before 15.64.8 (Legacy Windows 7 & 8)Affected
14.7.0 (Windows) to before 14.7.48855 (Windows)Affected
13.2.0 (Windows) to before 13.2.36230 (Windows)Affected
14.7.0 (Linux) to before 14.7.48855 (Linux)Affected
13.2.0 (Linux) to before 13.2.153995 (Linux)Affected
14.7.0 (MacOS) to before 14.7.48855 (MacOS)Affected
13.2.0 (MacOS) to before 13.2.153994 (MacOS)Affected

HostTeamViewer

15.0 to before 15.82Affected
15.64.0 (Legacy Windows 7 & 8) to before 15.64.8 (Legacy Windows 7 & 8)Affected
14.7.0 (Windows) to before 14.7.48855 (Windows)Affected
13.2.0 (Windows) to before 13.2.36230 (Windows)Affected
14.7.0 (Linux) to before 14.7.48855 (Linux)Affected
13.2.0 (Linux) to before 13.2.153995 (Linux)Affected
14.7.0 (MacOS) to before 14.7.48855 (MacOS)Affected
13.2.0 (MacOS) to before 13.2.153994 (MacOS)Affected

References

https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1010/vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.