TeamViewer just told every desktop owner to update before the weekend

TeamViewer published a rare “update as soon as possible” advisory covering five high-severity flaws in Full Client and Host on Windows, Linux, and macOS. The lead issue is a remote session access-control bypass that can let an attacker perform unauthorized actions that lead to remote code execution. Fixed builds land at version 15.82 (and supported maintenance / legacy lines).

TeamViewer says it has no evidence of public exploit code or active exploitation yet. Ransomware crews still like remote-access software once they have a foothold. Put the update in this week’s desktop patching.

If helpdesk still runs last month’s TeamViewer build, the weekend is not the time to find out.

The 5-Minute Cyber Brief

Know what matters before your first meeting.

Weekday mornings. Five minutes. What changed in security, why it matters.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Five flaws in Full Client and Host

On September 30, 2026, TeamViewer disclosed five issues affecting Full Client and Host:

• CVE-2026-92370 — remote session access-control bypass (improper access control) that can lead to remote code execution
• CVE-2026-19743 — path traversal
• CVE-2026-92368 — heap-based buffer overflow
• CVE-2026-92369 — TOCTOU race condition
• CVE-2026-92371 — improper path validation that can escalate to SYSTEM / root on local attack paths

All five are addressed in TeamViewer Clients version 15.82 and in supported maintenance and legacy releases. The company strongly recommends updating immediately and states it is not aware of public disclosure of exploit code or exploitation in the wild.

TeamViewer is on the machines attackers want

TeamViewer runs on helpdesk jump boxes, vendor laptops and remote-support installs that were meant to be temporary. A session access-control bypass there could turn a phishing click or a reused account into a remote session with desktop rights.

Nobody has confirmed exploitation. The update is easy, though, and the install base is large. Ransomware groups have abused remote-access tools for years, so there is little reason to leave Full Client and Host a release behind.

Get every install to 15.82

• Push 15.82 (or the fixed maintenance line). Cover Full Client and Host on Windows, Linux and macOS, including golden images and MDM profiles.
• Inventory forgotten agents. Search endpoints, Autopilot / Intune / Jamf inventories, and vendor VDI for TeamViewer Host that never got into the patch ring.
• Lock who can start sessions. Enforce SSO / conditional access where licensed, disable unattended access that is not required, and rotate shared TeamViewer accounts.
• Watch for odd session starts. Alert on TeamViewer connections outside helpdesk hours or from unexpected geographies for the next two weeks.

Details

• Product: TeamViewer Full Client and Host (Windows, Linux, macOS)
• Fixed version: 15.82 (+ supported maintenance / legacy lines)
• Lead CVE: CVE-2026-92370 (remote session access-control bypass → RCE path)
• Also fixed: CVE-2026-19743, CVE-2026-92368, CVE-2026-92369, CVE-2026-92371
• Exploitation: Vendor reports no known public PoC or active exploitation as of the advisory
• Disclosure: September 30, 2026

Hunt / verify

• Query EDR / software inventory for TeamViewer version < 15.82.
• Review TeamViewer Management Console connection logs for unexpected unattended sessions since mid-September.
• Confirm Host is absent from servers that do not need remote support.

TeamViewer Full Client/Host → 15.82 this week (CVE-2026-92370 session bypass + 4 other highs); inventory forgotten Host agents; watch odd session starts.

Sources

• TeamViewer Trust Center security bulletins (15.82 advisory)
• BleepingComputer: TeamViewer urges users to patch severe flaws “as soon as possible” (Sep 30, 2026)

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].