TeamViewer patches five critical flaws, urges immediate update to 15.82

TeamViewer published security bulletin TV-2026-1010 on Tuesday, covering five high-severity vulnerabilities in the client and host components of its remote-access software. The most serious, CVE-2026-92370, carries a CVSS score of 8.8 and lets a remote attacker bypass access controls and achieve arbitrary code execution. The German company is urging "all users to update to the latest version as soon as possible."

TeamViewer is not just any tool. It runs on tens of millions of machines, often with system-level privileges, because it needs to move the mouse, read the screen and transfer files on the user's behalf. A flaw that bypasses access controls in software with that level of privilege is not a footnote for specialists, it is a backdoor into the entire fleet of anyone using it for customer support, IT helpdesk work or remote server management.

The five flaws in bulletin TV-2026-1010

The bulletin covers TeamViewer Remote, Tensor and ONE, in the Full Client and Host builds for Windows, Linux and macOS prior to 15.82. The vulnerabilities touch different parts of the program (the IPC service, recorded-session playback, the installer, access control) and no single root cause: they are five distinct bugs, patched together in the same release.

TeamViewer claims more than 2.5 billion devices have had the software installed over the years, a network used above all by corporate help desks, industrial maintenance technicians and MSPs (the third-party managed IT service providers). MSPs are precisely the prime target in cases like this, since a single compromised login on remote-control software can open the door to dozens of downstream clients, not just one machine. It is the same pattern behind the infamous software supply-chain attacks: an intruder doesn't need to breach a hundred companies, just the one holding everyone else's keys.

CVE-2026-92370, the flaw that justifies an immediate update

The most serious defect stems from a poorly implemented access control check in the Full Client and Host, across all three supported operating systems. A remote attacker can exploit it to perform actions outside their permissions within a session, up to and including code execution on the target system. TeamViewer has not published the full exploit chain (standard practice until the patch is widely deployed), but the 8.8 score puts it near the top of the "high severity" band, one step below the 9.0+ threshold that usually marks a pure critical CVE.

The other four flaws require more specific conditions, a malicious file passed during a session, the installer launched at a precise moment, a crafted link on the Linux filesystem, but remain exploitable by anyone who already has some access to or interaction with the victim. None of the five is known to be under active exploitation for now: TeamViewer states it is not aware "of any public disclosure or active exploitation" as of the bulletin's publication.

Warning: the absence of known exploits today does not mean safety tomorrow. A public bulletin with assigned CVEs is the classic trigger for patch reverse engineering: anyone wanting to write an exploit compares the code before and after 15.82 and can reconstruct the bug within days.

Why remote-access software remains a fixed target

TeamViewer is no stranger to this kind of bulletin, and neither is the industry. We covered old or cracked installations of TeamViewer and AnyDesk used as an entry point for fake tech-support scams : in that case the risk wasn't a flaw in the code but an out-of-support client missing the latest security checks. Bulletin TV-2026-1010 tells the flip side of the same story: here the version is current at release time, the problem lies in the code itself, and the difference between the two threats comes down to who has to act. Against a cracked client, user wariness is the defense. Against a CVE with a CVSS of 8.8, applying the patch is the only defense needed.

The thread connecting both cases is the same: a program that, to do its job, needs near-complete access to the machine it runs on. It's the same principle behind RemControl, the Android banking trojan Group-IB found abusing accessibility services to control a victim's phone : the more permission a piece of software has to act on your behalf, the more costly a bug (or an abuse of that permission) becomes. In the industrial sector the problem is even more concrete: Clusit's manufacturing report notes one attack in five in Italy already hits industry , and remote-access tools used for machinery maintenance are among the most common entry vectors.

The pattern repeats outside the enterprise world too. The Municipality of Rimini discovered its official page had been hacked through compromised credentials, not a sophisticated exploit. Even the most careful vendors aren't immune: Apple had to rush out a fix for a CoreGraphics zero-day already exploited in targeted attacks . The constant across all these cases is the same: the window between a flaw's disclosure and the moment someone stops updating is where real incidents are born.

The bulletin number, TV-2026-1010, is no accident. TeamViewer has already published advisories TV-2026-1001, TV-2026-1003, TV-2026-1005 and TV-2026-1009 this year, a patching cadence that points to an active bug bounty program, not an inattentive vendor. Reporting and fixing a bug before anyone exploits it is the right behavior; the flip side is that every published bulletin also invites anyone looking for a shortcut to diff the old code against the new and mine it for an exploit.

How to update TeamViewer safely

The procedure is the same across all supported operating systems and requires no special expertise.

Check your installed version : open TeamViewer, go to Help and select " TeamViewer." If the number is below 15.82, you're exposed.

Download the latest version from the official teamviewer.com site, never from third-party mirrors or links received by email.

Restart the host service after updating, if you run TeamViewer as a permanent host on a server or an unattended PC: installing alone isn't enough if the running process is still the old one.

Check legacy versions (TeamViewer 13, 14, 15 on older operating systems): the bulletin also covers maintenance branches, with specific minimum builds listed in the official advisory.

On corporate networks , confirm with your IT administrator that centralized deployment (MSI, group policy) has already pushed the update to every machine, not just the ones checked manually.

Frequently Asked Questions (FAQ)

1. Do I need to update even if I don't use TeamViewer as a system administrator?

Yes, always. The five vulnerabilities affect both the Full Client and the Host: simply having the program installed and running, even for a single occasional connection, puts you in the attack surface.

2. Is TeamViewer 15.82 compatible with Windows 7 and older macOS versions?

It depends on the branch. The newest builds require operating systems still supported by the vendor; for Windows 7 and similar versions TeamViewer maintains separate maintenance branches (15.64.7 and later in the 15 series, with dedicated numbering for versions 13 and 14), listed in the official bulletin.

3. Can an attacker exploit CVE-2026-92370 without me opening anything?

No, an access vector to the session is required. The access-control bypass operates at the level of a TeamViewer session already established, or one the attacker can establish: it isn't a "zero-click" attack over the open internet, but exploits weaknesses in how the software verifies who is entitled to do what during a connection.

4. Is there a way to tell if I've already been hit?

Not with certainty from local logs alone. TeamViewer logs sessions (date, IP, duration) in the Management Console panel: a login from an unfamiliar IP or an unusual time is the first clue to check. Absent any public exploit, however, no detection signatures specific to these five CVEs exist yet.

5. Do the vulnerabilities also affect TeamViewer QuickSupport?

Bulletin TV-2026-1010 lists the Full Client and Host as the affected components; QuickSupport, the lightweight version for one-off support sessions, shares part of the same codebase and gets updated on the same release cycles, so the same advice applies: check the version in use.

A CVSS of 8.8 on software with privileged access isn't a statistic to file away, it's a concrete reminder for anyone managing PCs and servers remotely. TeamViewer patched the five flaws before they became public knowledge, which doesn't always happen. The rest of the work falls to the people who use it: update to 15.82 today, not at the scheduled maintenance window.