TeamViewer Remote Management Monitoring: Local privilege escalation via IPC
Summary
An improper access control flaw in the IPC communication between TeamViewer Full Client or Host and the Remote Management Monitoring component allows a local authenticated attacker with low privileges to execute scripts as SYSTEM or root. The attacker needs a valid low-privileged account on the affected machine, so the flaw matters mainly after an initial foothold, on shared multi-user systems or from insiders. Successful exploitation gives full control over the host.
Affected
- TeamViewer Full Client and Host prior to 15.83 (Windows, macOS, Linux)
- Legacy branches: 15.64 (Windows 7 and 8) prior to 15.64.10, 14.7 prior to 14.7.48868, 13.2 prior to 13.2.36231 (Windows) and 13.2.154008 (Linux)
- TeamViewer Remote Management Monitoring prior to 26.10.1 (ITbrain_Monitoring_Service.exe, MonitoringDaemon, teamviewer-monitoringd)
Fixed in
- TeamViewer Full Client and Host: 15.83 or later (legacy branches as listed above)
- TeamViewer Remote Management Monitoring: 26.10.1 or later
Workaround
Unknown. No vendor-documented workaround beyond patching.
Exploitation
- Vendor: TeamViewer is not aware of any active exploitation in the wild at the time of publication.
- No public exploit code confirmed (VulDB reports no available exploit).
- Not listed in CISA KEV according to third-party sources.
- EPSS: 0.1 % (percentile 1).
Our recommendation
- Inventory all TeamViewer Full Client, Host and Monitoring add-on installations, including Windows and Linux hosts.
- Update Full Client and Host to 15.83 or later and the Monitoring add-on to 26.10.1 or later.
- Verify the add-on version after the update, as automatic updates may not have reached every host.
- Prioritise shared and administrative workstations, terminal servers and hosts with local user accounts.
- Patch the related CVE-2026-92376, CVE-2026-92377, CVE-2026-111582, CVE-2026-111583, CVE-2026-111584 and CVE-2026-111585 in the same maintenance window.
- Monitor for unexpected script execution or service changes on managed hosts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- TeamViewer Security Bulletin TV-2026-1012 www.teamviewer.com
- VulDB CVE-2026-92375 vuldb.com
- TheHackerWire CVE-2026-92375 www.thehackerwire.com
- ThreatInt CVE record CVE-2026-92375 cve.threatint.com
- PBX Science: TeamViewer 15.83.3 released pbxscience.com
- BleepingComputer: TeamViewer urges users to patch severe flaws www.bleepingcomputer.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:13.
Original description (NVD)
An improper access control vulnerability in the IPC communication between TeamViewer Full Client or Host prior to version 15.83 and the Remote Management Monitoring component prior to version 26.10.1 allows a local authenticated attacker with low privileges to execute scripts as SYSTEM/root.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.