TI-2026-81367 Aliases CVE-2026-111584 GHSA-h5jh-rr9v-jv3h

Privilege escalation in TeamViewer Patch Management for Windows

LOW 33CWE-269Published 2026-10-27 · Updated 2026-11-04

Key facts

Attack vector: Local
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Privilege escalation
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

TeamViewer Remote - Patch Management for Windows before 26.9.1 is affected, as is the legacy v14.7 client before 24.12.5 (Legacy version for v14.7 client). A race condition in the installation process lets a local attacker replace the service executable in an insufficiently protected temporary directory during Patch Management activation. An authenticated local attacker with low privileges can run arbitrary code with elevated privileges. The flaw is classified as CWE-269.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

A race condition in the installation process of TeamViewer Remote Management - Patch Management for Windows prior to version 26.9.1 allows a local authenticated attacker with low privileges to execute arbitrary code with elevated privileges by replacing the service executable in an insufficiently protected temporary directory during Patch Management activation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00108 1st percentileScored 2026-11-07

Fix Fixed TeamViewer Remote - Patch Management (TeamViewer): 26.9.1, 24.12.5 (Legacy version for v14.7 client)

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
TeamViewer	TeamViewer Remote - Patch Management	before 26.9.1; 0 (Legacy version for v14.7 client) to before 24.12.5 (Legacy version for v14.7 client)	26.9.1, 24.12.5 (Legacy version for v14.7 client)	Patch available	CNA

TeamViewer Remote - Patch Management VendorTeamViewer Affected before 26.9.1; 0 (Legacy version for v14.7 client) to before 24.12.5 (Legacy version for v14.7 client) Fixed in 26.9.1, 24.12.5 (Legacy version for v14.7 client) Patch available CNA

Remediation

Update TeamViewer Remote - Patch Management to version 26.9.1. For the legacy v14.7 client, update to 24.12.5 (Legacy version for v14.7 client).

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Fix · CNA TeamViewer Remote - Patch Management (TeamViewer) Fixed in 26.9.1, 24.12.5 (Legacy version for v14.7 client)

Timeline

2026-10-27 Threatist record created from CVE-2026-111584
2026-10-27 Alias added: GHSA-h5jh-rr9v-jv3h
2026-10-28 Priority changed: MEDIUM → LOW
2026-11-04 CISA SSVC decision points changed

References

Advisory 1

https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1012/

TI-2019-13681 TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control… KEVCVSS 3.1HIGH 7.0
TI-2020-10745 TeamViewer Desktop for Windows before 15.8.3 does not properly quote its custom URI… CVSS 3.1HIGH 8.8
TI-2010-02989 Untrusted search path vulnerability in TeamViewer 5.0.8703 and earlier allows local… CVSS 2.0HIGH 9.3
TI-2021-13849 Memory corruption in TeamViewer CVSS 3.1HIGH 8.8
TI-2018-11870 TeamViewer 10.x through 13.x allows remote attackers to bypass the brute-force… CVSS 3.0CRITICAL 9.8
TI-2025-28565 File Hash Validation Bypass in NomadBranch.exe CVSS 3.1HIGH 8.8

See all 67 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences