Lack of Server-side validation in Instruction Input in TeamViewer DEX Platform (On-Premises)
Priority LOW 29CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
A command injection vulnerability was discovered in TeamViewer DEX Platform On-Premises (former 1E DEX Platform On-Premises) prior to version 9.2. Improper input validation allows authenticated users with at least questioner privileges to inject commands in specific instructions. Exploitation could lead to execution of elevated commands on devices connected to the platform.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00201 10th percentileScored 2026-11-07
Fix Fixed DEX (On-Premises) (TeamViewer): 9.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| TeamViewer | DEX (On-Premises) | before 9.2 | 9.2 | Patch available | CNA |
- DEX (On-Premises) VendorTeamViewer Affected before 9.2 Fixed in 9.2 Patch available CNA
Remediation
- Fix · CNA DEX (On-Premises) (TeamViewer) Fixed in 9.2
Timeline
- 2026-10-02 Threatist record created from CVE-2026-2695
- 2026-10-03 Alias added: GHSA-567r-vw5w-g2q6
References
More TeamViewer vulnerabilities
- TI-2019-13681 TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control… KEVCVSS 3.1HIGH 7.0
- TI-2020-10745 TeamViewer Desktop for Windows before 15.8.3 does not properly quote its custom URI… CVSS 3.1HIGH 8.8
- TI-2010-02989 Untrusted search path vulnerability in TeamViewer 5.0.8703 and earlier allows local… CVSS 2.0HIGH 9.3
- TI-2021-13849 Memory corruption in TeamViewer CVSS 3.1HIGH 8.8
- TI-2018-11870 TeamViewer 10.x through 13.x allows remote attackers to bypass the brute-force… CVSS 3.0CRITICAL 9.8
- TI-2025-28565 File Hash Validation Bypass in NomadBranch.exe CVSS 3.1HIGH 8.8
Sources
- CVE-2026-2695 · CVE Program
- CVE-2026-2695 · NVD
- FIRST EPSS
- GHSA-567r-vw5w-g2q6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences