Log in Start free

Vulnerability · Published Oct 27, 2026 · Assigned by TV

CVE-2026-111584Local Privilege Escalation via Race Condition in TeamViewer Patch Management for Windows

High 7.3

In plain English

A high-severity privilege mismanagement in TeamViewer Remote - Patch Management from TeamViewer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.1%top 98.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A race condition in the installation process of TeamViewer Remote Management - Patch Management for Windows prior to version 26.9.1 allows a local authenticated attacker with low privileges to execute arbitrary code with elevated privileges by replacing the service executable in an insufficiently protected temporary directory during Patch Management activation.

Affected products (as reported)

VendorProductVersions
TeamViewer TeamViewer Remote - Patch Management 0 – before 26.9.10 (Legacy version for v14.7 client) – before 24.12.5 (Legacy version for v14.7 client)

Weakness: CWE-269 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References