{"id":"CVE-2026-92370","state":"PUBLISHED","title":"Remote Session Access Control Bypass Leading to Remote Code Execution","description":"An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. By modifying access control parameters for restricted features, an attacker can perform actions that were explicitly denied by the victim's configuration. This may result in unauthorized actions and potentially lead to remote code execution on the target system.","publishedAt":"2026-09-29T15:42:27.283Z","updatedAt":"2026-09-30T15:28:18.681Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"TV"},"assigner":"TV","products":["TeamViewer Full Client","TeamViewer Host"],"affected":[{"vendor":"TeamViewer","product":"Full Client","defaultStatus":"unaffected","versions":[{"version":"15.0","status":"affected","lessThan":"15.82","versionType":"custom"},{"version":"15.64.0 (Legacy Windows 7 & 8)","status":"affected","lessThan":"15.64.8 (Legacy Windows 7 & 8)","versionType":"custom"},{"version":"14.7.0 (Windows)","status":"affected","lessThan":"14.7.48855 (Windows)","versionType":"custom"},{"version":"13.2.0 (Windows)","status":"affected","lessThan":"13.2.36230 (Windows)","versionType":"custom"},{"version":"14.7.0 (Linux)","status":"affected","lessThan":"14.7.48855 (Linux)","versionType":"custom"},{"version":"13.2.0 (Linux)","status":"affected","lessThan":"13.2.153995 (Linux)","versionType":"custom"},{"version":"14.7.0 (MacOS)","status":"affected","lessThan":"14.7.48855 (MacOS)","versionType":"custom"},{"version":"13.2.0 (MacOS)","status":"affected","lessThan":"13.2.153994 (MacOS)","versionType":"custom"}],"platforms":["Windows","Linux","MacOS"]},{"vendor":"TeamViewer","product":"Host","defaultStatus":"unaffected","versions":[{"version":"15.0","status":"affected","lessThan":"15.82","versionType":"custom"},{"version":"15.64.0 (Legacy Windows 7 & 8)","status":"affected","lessThan":"15.64.8 (Legacy Windows 7 & 8)","versionType":"custom"},{"version":"14.7.0 (Windows)","status":"affected","lessThan":"14.7.48855 (Windows)","versionType":"custom"},{"version":"13.2.0 (Windows)","status":"affected","lessThan":"13.2.36230 (Windows)","versionType":"custom"},{"version":"14.7.0 (Linux)","status":"affected","lessThan":"14.7.48855 (Linux)","versionType":"custom"},{"version":"13.2.0 (Linux)","status":"affected","lessThan":"13.2.153995 (Linux)","versionType":"custom"},{"version":"14.7.0 (MacOS)","status":"affected","lessThan":"14.7.48855 (MacOS)","versionType":"custom"},{"version":"13.2.0 (MacOS)","status":"affected","lessThan":"13.2.153994 (MacOS)","versionType":"custom"}],"platforms":["Windows","Linux","MacOS"]}],"references":["https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1010/"],"weaknesses":["CWE-284"],"ingestedAt":"2026-10-29T20:13:34.582Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/92xxx/CVE-2026-92370.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-92370","state":"PUBLISHED","datePublished":"2026-09-29T15:42:27.283Z","dateUpdated":"2026-09-30T15:28:18.681Z","assignerShortName":"TV","assignerOrgId":"13430f76-86eb-43b2-a71c-82c956ef31b6","dateReserved":"2026-09-16T07:16:01.956Z"},"containers":{"cna":{"title":"Remote Session Access Control Bypass Leading to Remote Code Execution","descriptions":[{"lang":"en","value":"An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. By modifying access control parameters for restricted features, an attacker can perform actions that were explicitly denied by the victim's configuration. This may result in unauthorized actions and potentially lead to remote code execution on the target system."}],"affected":[{"vendor":"TeamViewer","product":"Full Client","defaultStatus":"unaffected","versions":[{"version":"15.0","status":"affected","lessThan":"15.82","versionType":"custom"},{"version":"15.64.0 (Legacy Windows 7 & 8)","status":"affected","lessThan":"15.64.8 (Legacy Windows 7 & 8)","versionType":"custom"},{"version":"14.7.0 (Windows)","status":"affected","lessThan":"14.7.48855 (Windows)","versionType":"custom"},{"version":"13.2.0 (Windows)","status":"affected","lessThan":"13.2.36230 (Windows)","versionType":"custom"},{"version":"14.7.0 (Linux)","status":"affected","lessThan":"14.7.48855 (Linux)","versionType":"custom"},{"version":"13.2.0 (Linux)","status":"affected","lessThan":"13.2.153995 (Linux)","versionType":"custom"},{"version":"14.7.0 (MacOS)","status":"affected","lessThan":"14.7.48855 (MacOS)","versionType":"custom"},{"version":"13.2.0 (MacOS)","status":"affected","lessThan":"13.2.153994 (MacOS)","versionType":"custom"}],"platforms":["Windows","Linux","MacOS"]},{"vendor":"TeamViewer","product":"Host","defaultStatus":"unaffected","versions":[{"version":"15.0","status":"affected","lessThan":"15.82","versionType":"custom"},{"version":"15.64.0 (Legacy Windows 7 & 8)","status":"affected","lessThan":"15.64.8 (Legacy Windows 7 & 8)","versionType":"custom"},{"version":"14.7.0 (Windows)","status":"affected","lessThan":"14.7.48855 (Windows)","versionType":"custom"},{"version":"13.2.0 (Windows)","status":"affected","lessThan":"13.2.36230 (Windows)","versionType":"custom"},{"version":"14.7.0 (Linux)","status":"affected","lessThan":"14.7.48855 (Linux)","versionType":"custom"},{"version":"13.2.0 (Linux)","status":"affected","lessThan":"13.2.153995 (Linux)","versionType":"custom"},{"version":"14.7.0 (MacOS)","status":"affected","lessThan":"14.7.48855 (MacOS)","versionType":"custom"},{"version":"13.2.0 (MacOS)","status":"affected","lessThan":"13.2.153994 (MacOS)","versionType":"custom"}],"platforms":["Windows","Linux","MacOS"]}],"references":[{"url":"https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1010/","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseSeverity":"HIGH","baseScore":8.8,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-284","lang":"en","description":"CWE-284 Improper Access Control","type":"CWE"}]}],"providerMetadata":{"shortName":"TV","orgId":"13430f76-86eb-43b2-a71c-82c956ef31b6","dateUpdated":"2026-09-29T15:42:27.283Z"},"impacts":[{"capecId":"CAPEC-113","descriptions":[{"lang":"en","value":"CAPEC-113 Interface Manipulation"}]}],"solutions":[{"lang":"en","value":"Update to the latest version.","supportingMedia":[{"type":"text/html","base64":false,"value":"Update to the latest version."}]}],"credits":[{"lang":"en","value":"We thank HeaZzy (Mathys KHALFA) & skav (Antoine RIEUL) for the discovery and responsible disclosure.","type":"finder"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.5"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-92370","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-30T15:12:37.475626Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-30T15:28:18.681Z"}}]}}}