C V E - 2 0 2 6 - 9 2 3 7 0 : T e a m V i e w e r A u t h e n t i c a t i o n B y p a s s V u l n e r a b i l i t y

C V E - 2 0 2 6 - 9 2 3 7 0 i s a n a u t h e n t i c a t i o n b y p a s s v u l n e r a b i l i t y i n T e a m V i e w e r t h a t a l l o w s a t t a c k e r s t o o v e r r i d e p e r m i s s i o n s e t t i n g s a n d p o t e n t i a l l y e x e c u t e r e m o t e c o d e . T h i s p o s t e x p l a i n s i t s i m p a c t , a f f e c t e d v e r s i o n s , a n d m i t i g a t i o n s t e p s .

CVE-2026-92370 Overview

CVE-2026-92370 is an improper access control vulnerability [CWE-284] affecting TeamViewer Full Client, Host, and related modules on Windows, Linux, and macOS. An authenticated remote attacker can bypass user-configured permission settings during session establishment. By manipulating access control parameters for restricted features, the attacker performs actions the victim explicitly denied in configuration. Successful exploitation may lead to unauthorized actions and, in some scenarios, remote code execution on the target system.

Critical Impact
An authenticated remote attacker can override user-defined permission restrictions, execute denied operations, and potentially achieve remote code execution on affected TeamViewer endpoints.

Affected Products

TeamViewer Full Client on Windows, Linux, and macOS
TeamViewer Host on Windows, Linux, and macOS
Related affected TeamViewer modules as listed in vendor bulletin TV-2026-1010

Discovery Timeline

2026-09-29 - CVE CVE-2026-92370 published to NVD
2026-09-30 - Last updated in NVD database
Vendor reference: TeamViewer Security Bulletin TV-2026-1010

Technical Details for CVE-2026-92370

Vulnerability Analysis

The flaw resides in how TeamViewer enforces user-configured permission settings when a remote session is established. During session negotiation, the client accepts access control parameters that should be validated against the victim's local configuration. The affected components fail to enforce those restrictions server-side on the receiving endpoint. An authenticated remote attacker who initiates a session can therefore request capabilities the victim previously denied. Because the bypass occurs at the permission-enforcement layer, actions such as input control, file transfer, or scripted operations may become available without the victim's consent. The attack requires user interaction to accept or approve the session, consistent with typical TeamViewer connection flows.

Root Cause

The root cause is improper access control [CWE-284] within the session establishment logic. Client-supplied access control parameters are trusted rather than reconciled against the victim's persisted permission policy. This allows the attacker to override explicit deny settings for restricted features.

Attack Vector

The attack is network-based and requires the attacker to hold valid authentication for establishing a session with the target. Once a session is initiated and accepted, the attacker modifies access control parameters to enable features the victim disabled. Depending on which features are re-enabled, follow-on actions can include file operations, remote input, or execution flows that culminate in code execution. Refer to the TeamViewer Security Bulletin TV-2026-1010 for the full list of affected modules and fixed versions.

Detection Methods for CVE-2026-92370

Indicators of Compromise

Unexpected inbound TeamViewer sessions to hosts where remote control, file transfer, or scripting was explicitly disabled in local configuration.
TeamViewer connection log entries (Connections_incoming.txt) showing sessions that performed actions inconsistent with the host's configured permission profile.
New or modified files, scheduled tasks, or persistence artifacts created shortly after a TeamViewer session terminated.

Detection Strategies

Correlate TeamViewer session start and end events with process creation, file write, and network activity on the endpoint during the session window.
Alert on TeamViewer child processes (cmd.exe, powershell.exe, bash, script interpreters) spawned by TeamViewer_Service.exe or TeamViewer.exe.
Baseline expected TeamViewer usage per host and flag sessions from unfamiliar TeamViewer IDs or geographies.

Monitoring Recommendations

Forward TeamViewer client and service logs to a centralized SIEM for retention and correlation.
Monitor endpoints for outbound connections to *.teamviewer.com from hosts that should not run the client.
Track version telemetry to confirm all TeamViewer installations meet the patched build specified in TV-2026-1010.

How to Mitigate CVE-2026-92370

Immediate Actions Required

Upgrade TeamViewer Full Client, Host, and any related affected modules to the fixed versions listed in TeamViewer Security Bulletin TV-2026-1010.
Inventory all endpoints running TeamViewer and prioritize patching internet-exposed hosts and privileged workstations.
Rotate TeamViewer account credentials and enforce multi-factor authentication for all accounts able to initiate sessions.

Patch Information

TeamViewer has released fixed builds referenced in security bulletin TV-2026-1010. Consult the vendor advisory for exact version numbers per platform (Windows, Linux, macOS) and per affected module. Apply updates through the built-in update mechanism, managed deployment tooling, or the TeamViewer Management Console.

Workarounds

Restrict TeamViewer to allow-listed accounts and devices using the vendor's conditional access and allow-list features until patching is complete.
Disable unattended access on hosts that do not require it and require interactive approval for every incoming session.
Block TeamViewer traffic at the perimeter for user groups and network segments where remote access is not required.

bash

# Windows: query installed TeamViewer version to confirm patch level
reg query "HKLM\SOFTWARE\WOW6432Node\TeamViewer" /v Version

# Linux: verify installed package version
dpkg -l | grep -i teamviewer

# macOS: verify application version
defaults read /Applications/TeamViewer.app/Contents/Info.plist CFBundleShortVersionString