CVE-2026-23564: TeamViewer DEX Client Info Disclosure Flaw

CVE-2026-23564 Overview

A vulnerability has been identified in TeamViewer DEX Client (formerly known as 1E Client) - Content Distribution Service (NomadBranch.exe) prior to version 26.1 for Windows. This cleartext transmission vulnerability allows an attacker on an adjacent network to cause normally encrypted UDP traffic to be sent in cleartext, resulting in potential disclosure of sensitive information.

Critical Impact

Attackers on adjacent networks can intercept sensitive data transmitted via UDP that should be encrypted, leading to information disclosure without requiring authentication or user interaction.

Affected Products

• TeamViewer DEX Client (former 1E Client) for Windows prior to version 26.1
• Content Distribution Service (NomadBranch.exe) component

Discovery Timeline

• 2026-01-29 - CVE-2026-23564 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-23564

Vulnerability Analysis

This vulnerability is classified under CWE-319 (Cleartext Transmission of Sensitive Information). The Content Distribution Service component (NomadBranch.exe) in TeamViewer DEX Client fails to properly enforce encryption for UDP traffic under certain conditions. An attacker positioned on an adjacent network segment can exploit this flaw to intercept data that would normally be protected by encryption.

The vulnerability requires the attacker to have adjacent network access, meaning they must be on the same network segment as the vulnerable system. However, once in position, no authentication or user interaction is required to exploit the vulnerability. The impact is limited to confidentiality—there is no direct impact to integrity or availability of the affected systems.

Root Cause

The root cause of this vulnerability lies in improper implementation of encryption controls within the Content Distribution Service. Under specific conditions, the NomadBranch.exe process transmits UDP traffic in cleartext rather than applying the expected encryption. This represents a failure in the secure communication protocol implementation, allowing sensitive information to be exposed during network transmission.

Attack Vector

The attack vector for CVE-2026-23564 requires adjacent network access. An attacker must be positioned on the same local network segment as the target system running the vulnerable TeamViewer DEX Client. From this position, the attacker can passively monitor network traffic using standard packet capture tools to intercept the cleartext UDP transmissions.

The attack does not require any special privileges, authentication credentials, or user interaction. Once the attacker has network adjacency, they can capture sensitive data being transmitted by the Content Distribution Service that should have been encrypted. This makes the vulnerability particularly concerning in shared network environments such as corporate LANs, shared office spaces, or environments with guest network access.

Detection Methods for CVE-2026-23564

Indicators of Compromise

• Unencrypted UDP traffic originating from NomadBranch.exe on the local network
• Network packet captures showing cleartext data in UDP streams from TeamViewer DEX Client
• Anomalous network traffic patterns from Content Distribution Service components

Detection Strategies

• Monitor network traffic for unencrypted UDP packets originating from NomadBranch.exe processes
• Implement network intrusion detection rules to identify cleartext transmission patterns from DEX Client components
• Deploy deep packet inspection to detect sensitive data transmitted without encryption from known TeamViewer DEX Client ports

Monitoring Recommendations

• Enable detailed logging on network security appliances to capture UDP traffic anomalies
• Implement SentinelOne network visibility features to monitor process-level network communications
• Regularly audit network traffic from systems running TeamViewer DEX Client for encryption compliance

How to Mitigate CVE-2026-23564

Immediate Actions Required

• Upgrade TeamViewer DEX Client to version 26.1 or later immediately
• Audit all systems running the affected Content Distribution Service component
• Implement network segmentation to limit adjacent network access to vulnerable systems
• Monitor network traffic for signs of exploitation until patches are applied

Patch Information

TeamViewer has released version 26.1 of the DEX Client which addresses this vulnerability. Organizations should upgrade all instances of TeamViewer DEX Client (former 1E Client) to version 26.1 or later. For detailed patch information and download links, refer to the TeamViewer Security Bulletin TV-2026-1001.

Workarounds

• Restrict network access to systems running the vulnerable DEX Client to trusted network segments only
• Implement strict network segmentation to prevent adjacent network attacks
• Use VPN or additional encryption layers for network communications involving the affected component
• Consider temporarily disabling the Content Distribution Service if not critical to operations until the patch can be applied

# Verify installed TeamViewer DEX Client version (Windows PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" | Where-Object { $_.DisplayName -like "*DEX Client*" -or $_.DisplayName -like "*1E Client*" } | Select-Object DisplayName, DisplayVersion