Vulnerability · Published Sep 29, 2026 · Assigned by TV
CVE-2026-92370Remote Session Access Control Bypass Leading to Remote Code Execution
High 8.8
In plain English
A high-severity improper access control in Full Client from TeamViewer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).
Official description
An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. By modifying access control parameters for restricted features, an attacker can perform actions that were explicitly denied by the victim's configuration. This may result in unauthorized actions and potentially lead to remote code execution on the target system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TeamViewer | Full Client | 15.0 – before 15.8215.64.0 (Legacy Windows 7 & 8) – before 15.64.8 (Legacy Windows 7 & 8)14.7.0 (Windows) – before 14.7.48855 (Windows)13.2.0 (Windows) – before 13.2.36230 (Windows)14.7.0 (Linux) – before 14.7.48855 (Linux)13.2.0 (Linux) – before 13.2.153995 (Linux)14.7.0 (MacOS) – before 14.7.48855 (MacOS)13.2.0 (MacOS) – before 13.2.153994 (MacOS) |
| TeamViewer | Host | 15.0 – before 15.8215.64.0 (Legacy Windows 7 & 8) – before 15.64.8 (Legacy Windows 7 & 8)14.7.0 (Windows) – before 14.7.48855 (Windows)13.2.0 (Windows) – before 13.2.36230 (Windows)14.7.0 (Linux) – before 14.7.48855 (Linux)13.2.0 (Linux) – before 13.2.153995 (Linux)14.7.0 (MacOS) – before 14.7.48855 (MacOS)13.2.0 (MacOS) – before 13.2.153994 (MacOS) |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H