TeamViewer Remote Management Monitoring: Local privilege escalation via IPC
Summary
The IPC mechanism of TeamViewer Remote Management Monitoring for Windows does not properly authenticate its broker. A local attacker with a low-privileged account can impersonate the IPC broker and make the Monitoring service run arbitrary code as NT AUTHORITY\SYSTEM. Exploitation requires a local logon or an existing foothold on an endpoint where the Monitoring add-on is installed; the flaw is not remotely exploitable by itself.
Affected
- ITbrain_Monitoring_Service.exe (TeamViewer Remote Management Monitoring add-on for Windows) prior to 26.10.1
- VulDB describes the affected range as up to 26.10.0.
Fixed in
- Version 26.10.1 or later (Windows fix version taken from the "prior to 26.10.1" wording in the CVE record and vendor bulletin TV-2026-1012; the Windows row of the bulletin table could not be verified).
Workaround
- Unknown. The vendor has published no workaround; its guidance is to update.
- Interim measures (not vendor guidance): uninstall the Monitoring add-on if it is not needed, and restrict local logon and local administrator rights on affected endpoints.
Exploitation
- TeamViewer is not aware of active exploitation at the time of publication.
- Third-party mirrors list the CVE as not in the CISA KEV catalog; this has not been verified against the catalog itself.
- No public proof-of-concept code has been found; this is not a confirmed negative.
- CVSS 3.1 base score 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), EPSS 0.13 %.
Our recommendation
- Inventory all TeamViewer Remote Management Monitoring installations, including add-ons delivered via auto-update.
- Update to version 26.10.1 or later and verify the installed version afterwards.
- Patch related CVEs of the same bulletin together, including CVE-2026-92375 and CVE-2026-111582, and update TeamViewer Full Client and Host to 15.83 or later.
- Prioritise shared workstations, terminal servers and endpoints where staff or contractors have local logon.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- TeamViewer Security Bulletin TV-2026-1012 www.teamviewer.com
- VulDB CVE-2026-92376 vuldb.com
- CVE-2026-92376 mirror (threatint) cve.threatint.com
- Strix CVE-2026-92376 www.strix.ai
- TheHackerWire CVE-2026-92376 www.thehackerwire.com
- OpenCVE Remote Management Monitoring app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:11.
Original description (NVD)
Improper authentication in the inter-process communication (IPC) mechanism of TeamViewer Remote Management Monitoring for Windows prior to version 26.10.1 allows a local authenticated attacker with low privileges to impersonate the IPC broker and cause the Monitoring service to execute arbitrary code with NT AUTHORITY\SYSTEM privileges, resulting in local privilege escalation.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.