TeamViewer 15.82 Fixes Five High-Severity Flaws, Including Remote Session Permission Bypass

Tools like TeamViewer are how help desks and administrators reach machines they are not sitting at. A flaw in one of them affects a trusted access path, not just one app. If your organisation installed TeamViewer Host across its devices years ago and hasn't checked it since, now is the time.

What TeamViewer disclosed​

TeamViewer's bulletin says it has released security updates for "multiple vulnerabilities affecting TeamViewer Full Client and Host and related services." The fixes are in version 15.82 and in supported maintenance and legacy releases. SecurityOnline, which reviewed the same bulletin, reported that TeamViewer disclosed five TeamViewer vulnerabilities on September 29, 2026, in its Full Client and Host for Windows, Linux, and macOS. It added that all five are rated High, and the worst, CVE-2026-92370, scores CVSS 8.8.

BleepingComputer quoted the company's warning: "TeamViewer strongly recommends that all users update to the latest available version as soon as possible".

TeamViewer also says it "is not aware of any public disclosure or active exploitation in the wild." That describes what the vendor knows today. It does not prove nobody is exploiting the flaws, and attackers tend to study patches soon after release.

The five CVEs​

Most news summaries lump all five together. The bulletin shows they differ a lot in platform, attack path and required access, so here they are one at a time.

CVE-2026-92370: remote session access-control bypass (CVSS 8.8)​

• Platforms: Windows, Linux and macOS
• Affected: Full Client and Host before 15.82, plus the 15.64 (Windows), 14.7 and 13.2 legacy/maintenance branches
• Weakness: CWE-284, Improper Access Control

TeamViewer says an authenticated remote attacker can get around the permission settings a user configured while a session is being set up. By changing access-control parameters for restricted features, the attacker can do things the victim's settings explicitly block. The bulletin says this "may result in unauthorized actions and potentially lead to remote code execution."

The bulletin's own details don't quite agree with each other. The description calls the attacker authenticated, but the CVSS vector (AV:N/AC:L/PR:N/UI:R) says no privileges required and user interaction required. We're reporting both as published. What seems clear is that the attacker needs to be part of a session being set up, so this is not an anonymous internet-wide attack on every TeamViewer machine.

CVE-2026-19743: path traversal to SYSTEM or root (CVSS 7.8)​

• Platforms: Windows, macOS and Linux before 15.82. Legacy entries list 15.64 (Windows), 14.7 (Windows, Linux) and 13.2 (Windows, Linux)
• Weakness: CWE-22, Path Traversal

TeamViewer runs a local IPC (inter-process communication) service. A low-privileged local user can send it crafted commands that manipulate file paths. The result is arbitrary file writes with elevated rights: NT AUTHORITY\SYSTEM on Windows, root on Linux and macOS. Put simply, a standard user account becomes a way to take over the whole machine.

CVE-2026-92368: crafted session recording can run code (CVSS 7.8)​

• Platforms: Linux and macOS only
• Affected: 15.70 up to, but not including, 15.82
• Weakness: CWE-122, Heap-based Buffer Overflow

This flaw is in how TeamViewer processes .tvs session-recording files. A size mismatch during decompression can cause out-of-bounds heap writes. If someone persuades a user to open a crafted recording through the "Play or convert recorded session…" feature, the attacker's code can run with that user's privileges. Windows builds are not listed for this one.

Here too the vector (UI:N) conflicts with the description, which requires the user to open a malicious file.

CVE-2026-92369: Windows installer rollback race (CVSS 7.3)​

• Platforms: Windows only
• Affected: before 15.82, plus the 15.64, 14.7 and 13.2 Windows branches
• Weakness: CWE-367, TOCTOU (time-of-check to time-of-use) race condition

If an install or update fails and rolls back, the elevated installer restores backup files from a temporary folder that ordinary users can write to. A local low-privileged attacker who swaps those files at the right moment could gain NT AUTHORITY\SYSTEM. TeamViewer notes that exploitation needs both precise timing and an actual rollback during installation or update. That's hard to pull off, but it does happen.

CVE-2026-92371: Cloud Session Recording link following (CVSS 7.0)​

• Platforms: Linux only
• Affected: 15.0 up to, but not including, 15.82
• Weakness: CWE-59, Improper Link Resolution Before File Access

TeamViewer's Cloud Session Recording (CSR) feature has a race between checking a file path and then using it. A local authenticated attacker could exploit that gap to make privileged file operations land in unintended places. This entry has the highest attack complexity of the five (AC:H).

Section summary: One flaw affects remote sessions on all three desktop platforms. The other four need local access or a user opening a file, and some apply to only one operating system. On Windows, the three that matter are CVE-2026-92370, CVE-2026-19743 and CVE-2026-92369.

Which build do you need?​

TeamViewer's general advice is to update to 15.82 or the latest version available. Older branches have their own fixed builds. From the bulletin's affected-software table (Full Client and Host alike):

SecurityOnline summarised it the same way: update Full Client and Host to 15.82. Legacy users should install 15.64.8, 14.7.48855, or the fixed 13.2 build for their platform.

Note the 15.64 line. Organisations still running TeamViewer on Windows 7 or 8 get a separate build and should not assume 15.82 applies to them.

A practical patch plan for Windows admins​

1. Find every install. Use your endpoint management or software inventory tool (Intune, Configuration Manager or a third-party RMM) to locate all TeamViewer Full Client and Host installations. Unattended Host installs are the easiest to forget.
2. Sort by branch. Separate current 15.x installs from 15.64, 14.7 and 13.2 legacy installs. Each needs a different target build.
3. Deploy the matching update. Anything on the current branch goes to 15.82 or later. Legacy machines get the fixed builds in the table above.
4. Check the result. After deployment, confirm the reported version meets or exceeds the fixed build. On a single Windows 11 PC, the installed-apps list in Settings shows the version number.
5. Watch the update itself. CVE-2026-92369 involves installer rollback. Keep an eye on updates that fail, and on machines where untrusted users have local accounts.
6. Tighten local access. SecurityOnline suggests you also limit who can log in locally to machines running TeamViewer, since most of these TeamViewer vulnerabilities need local access. Where recordings are involved, it advises that until you patch, avoid opening .tvs files from unknown sources.

Those last two tips come from SecurityOnline, not TeamViewer. TV-2026-1010 lists no workaround at all, only the update. Treat them as ways to reduce risk while you roll out the patch, not as substitutes for it.

"Rare advisory"? The 2026 record says otherwise​

BleepingComputer called this "a rare advisory." TeamViewer's own bulletin numbering tells a different story: TV-2026-1010 is at least the tenth bulletin of 2026, and several earlier ones also covered the desktop clients:

• February (TV-2026-1003): TeamViewer told users to update to the latest client version (15.74.5 or the latest version available). Techzine reported that bug was registered under CVE-2026-23572 and has a CVSS score of 7.2. Like the new remote-session flaw, it involved getting past access controls, and it affected all versions of TeamViewer Full and TeamViewer Host older than version 15.74.5.
• August (TV-2026-1008): Release notes collected by Releasebot show macOS legacy builds that fixed a security vulnerability in the file transfer and clipboard features that could allow unauthorized file writes (Security Bulletin: TV-2026-1008).
• Early September (TV-2026-1009): Roughly three weeks ago, TeamViewer's advice was to update to the latest version (15.81.5 or the latest version available), and it suggested not clicking links received through chat as a stopgap.

So a machine that hasn't been updated since spring may be missing several rounds of fixes, not just this one. The February bulletin included an optional access-control mitigation, but TV-2026-1010 offers none. You shouldn't assume that setting protects against CVE-2026-92370.

The number of bulletins can be read two ways. It could mean a lot of weaknesses keep turning up. It could also mean TeamViewer is disclosing openly through coordinated reporting. TV-2026-1010 credits outside researchers who reported responsibly, which supports the second reading. Either way, the practical lesson is the same: remote-access tools need a regular update schedule, not an install-and-forget approach.

Why remote-access tools attract attackers​

As BleepingComputer points out, criminals, including ransomware gangs, often abuse TeamViewer to get into victims' machines and deploy malware. The company has also had its own breaches. One in 2016, disclosed in May 2019, was linked to Chinese actors using the Winnti backdoor. A breach of its internal corporate network disclosed two years ago was attributed to the Russian state-backed group Midnight Blizzard (also known as APT29). Neither incident is connected to these CVEs. They do show why TeamViewer is a frequent target.

The permission-bypass flaw is the most worrying of the five. Permission settings are what stop a support session from turning into full control of the machine. If an attacker can quietly override them, a user's careful configuration stops protecting them. The local privilege-escalation bugs are less dramatic but still useful to attackers, who routinely combine a small foothold with a way to reach SYSTEM or root.

Bottom line​

TeamViewer has fixed five high-severity flaws in Full Client and Host. The most serious, CVE-2026-92370, lets an attacker in a remote session get around user-set permissions on Windows, Linux and macOS. Here's what to do:

• Update to 15.82 or later, or to the matching fixed legacy build (15.64.8, 14.7.48855 or the platform-specific 13.2 build).
• Include Host installs and Windows 7/8 machines in your inventory.
• Don't wait for news of exploitation. TeamViewer says it knows of none so far, but it offers no workaround other than updating.

Summary​

• TeamViewer bulletin TV-2026-1010 (September 29, 2026) fixes five high-severity flaws in Full Client and Host. The worst, CVE-2026-92370 (CVSS 8.8), bypasses session permissions and could lead to remote code execution.
• Two other flaws affect Windows: CVE-2026-19743 (7.8), a path traversal to SYSTEM, and CVE-2026-92369 (7.3), an installer rollback race. CVE-2026-92368 affects only Linux and macOS, and CVE-2026-92371 only Linux.
• Update to 15.82 or later, or install the fixed legacy build for your branch and platform. The bulletin lists no workaround.
• TeamViewer says it knows of no public disclosure or exploitation so far. This is its tenth-plus bulletin of 2026, so machines that missed earlier updates may be further behind.