TeamViewer just told every desktop owner to update before the weekend

TeamViewer published a rare “update as soon as possible” advisory covering five high-severity flaws in Full Client and Host on Windows, Linux, and macOS. The lead issue is a remote session access-control bypass that can let an attacker perform unauthorized actions that lead to remote code execution. Fixed builds land at version 15.82 (and supported maintenance / legacy lines).

TeamViewer says it has no evidence of public exploit code or active exploitation yet. Remote-access software is still a favorite handoff for ransomware crews once they have a foothold — so treat the update as this week’s desktop hygiene, not a research footnote.

If helpdesk still runs last month’s TeamViewer build, the weekend is not the time to find out.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

What happened

On September 30, 2026, TeamViewer disclosed five issues affecting Full Client and Host:

• CVE-2026-92370 — remote session access-control bypass (improper access control) that can lead to remote code execution
• CVE-2026-19743 — path traversal
• CVE-2026-92368 — heap-based buffer overflow
• CVE-2026-92369 — TOCTOU race condition
• CVE-2026-92371 — improper path validation that can escalate to SYSTEM / root on local attack paths

All five are addressed in TeamViewer Clients version 15.82 and in supported maintenance and legacy releases. The company strongly recommends updating immediately and states it is not aware of public disclosure of exploit code or exploitation in the wild.

Why it matters

TeamViewer sits on helpdesk jump boxes, vendor laptops, and “temporary” remote-support installs that somehow become permanent. A session access-control bypass on that class of software turns a phishing click or a reused account into a remote operator with desktop rights.

Even without confirmed exploitation today, the patch bar is low and the install base is wide. Ransomware groups have abused remote-access tools for years; leaving Full Client and Host a release behind is an unforced error.

What to do first

• Push 15.82 (or the fixed maintenance line). Cover Full Client and Host on Windows, Linux, and macOS — including golden images and MDM profiles.
• Inventory forgotten agents. Search endpoints, Autopilot / Intune / Jamf inventories, and vendor VDI for TeamViewer Host that never got into the patch ring.
• Lock who can start sessions. Enforce SSO / conditional access where licensed, disable unattended access that is not required, and rotate shared TeamViewer accounts.
• Watch for odd session starts. Alert on TeamViewer connections outside helpdesk hours or from unexpected geographies for the next two weeks.

Details

• Product: TeamViewer Full Client and Host (Windows, Linux, macOS)
• Fixed version: 15.82 (+ supported maintenance / legacy lines)
• Lead CVE: CVE-2026-92370 (remote session access-control bypass → RCE path)
• Also fixed: CVE-2026-19743, CVE-2026-92368, CVE-2026-92369, CVE-2026-92371
• Exploitation: Vendor reports no known public PoC or active exploitation as of the advisory
• Disclosure: September 30, 2026

Hunt / verify

• Query EDR / software inventory for TeamViewer version < 15.82.
• Review TeamViewer Management Console connection logs for unexpected unattended sessions since mid-September.
• Confirm Host is absent from servers that do not need remote support.

Slack paste: TeamViewer Full Client/Host → 15.82 this week (CVE-2026-92370 session bypass + 4 other highs); inventory forgotten Host agents; watch odd session starts.

Sources

• TeamViewer Trust Center security bulletins (15.82 advisory)
• BleepingComputer: TeamViewer urges users to patch severe flaws “as soon as possible” (Sep 30, 2026)

George Bailey

George Bailey is a cybersecurity researcher and writer at CyberExperts, covering cyber threats, AI, cloud security, vulnerabilities, and defensive strategies. His goal is to help security professionals quickly understand what matters most and how it impacts their organizations.