- It is essential to update Full Client and Host to version 15.82 or higher to correct critical security vulnerabilities.
- The vulnerabilities detected allow for privilege escalation and remote code execution on Windows, macOS, and Linux.
- Comprehensive security requires combining official patches with the use of MFA, the principle of least privilege, and log monitoring.
If you use TeamViewer for technical support or remote team management, you know it's a powerful tool, but like all complex software, it's not perfect. Several serious security vulnerabilities have recently come to light affecting different versions of both the client and the host, meaning that if you're behind on updates, you could be vulnerable to intruders.
The situation is serious because these vulnerabilities don't affect just one system; they're spread across Windows, Linux, and macOS . To avoid unpleasant surprises, it's not enough to simply know you have the program installed. You need to get down to specifics and check the exact version, product, and operating system to ensure there are no vulnerabilities that could be exploited.
The critical failures detected and their risks
The official bulletin TV-2026-1010 has highlighted five CVEs with high severity. The most dangerous of these is CVE-2026-92370 , which has a CVSS score of 8.8. This vulnerability is particularly serious because it allows access control restrictions configured by the administrator to be bypassed, potentially leading to remote code execution. Essentially, someone could perform actions that you had explicitly prohibited in the session.
On the other hand, we have CVE-2026-19743 , which focuses on local privilege escalation. Here, a user already logged into the system but with limited permissions could manipulate file paths to gain SYSTEM or root privileges . Imagine an attacker logs in as a standard user and suddenly becomes the absolute administrator of the system; that's where the real problem begins.
We cannot forget the risks associated with files. CVE-2026-92368 affects those who open session recordings with the .tvs extension on macOS and Linux. A malicious file could cause a buffer overflow in memory , allowing the attacker to execute code with the permissions of the user who opens the file. Therefore, opening files from dubious sources is like playing Russian roulette.
Finally, there are more specific vulnerabilities such as CVE-2026-92369 , which is a race condition (TOCTOU) in the Windows installer that allows privilege escalation, and CVE-2026-92371 , which affects cloud session recording in Linux due to poor path validation.
How to fix the problem and which versions to install
The solution is clear and straightforward: update to version 15.82 or the latest available version. This applies to both the Full Client and the TeamViewer Host, which is often overlooked on servers and unattended access devices. If you're using very old versions that are still maintained, there are specific patches available depending on the branch.
- For Windows 7 and 8, the correct version is 15.64.8.
- In the 14.7 branch, you should look for version 14.7.48855.
- For branch 13.2, the versions vary: 13.2.36230 on Windows, 13.2.153995 on Linux and 13.2.153994 on macOS.
It's very important not to be fooled by urgent emails promising quick updates. Many cybercriminals exploit these alerts to launch phishing campaigns with fake links or malicious executables . The only safe way to update is through official TeamViewer channels or your company's deployment systems.
Additional security measures for businesses
Patching the software is the first step, but it's not a magic bullet. For peace of mind, it's advisable to implement a defense-in-depth strategy . This includes enabling multi-factor authentication (MFA), since although it doesn't fix the code bug, it prevents someone from gaining access using only a stolen password. It's also vital to apply the principle of least privilege , ensuring that users don't work as local administrators unless absolutely necessary.
In professional environments, monitoring tools like SIEM or EDR are very useful . These solutions allow you to detect anomalous behavior, such as unexpected processes or sudden changes in protected files, which could indicate that someone has already exploited a vulnerability before you've applied the patch. Maintaining a comprehensive log history (up to 400 days) is crucial for forensic analysis if you discover an attack that occurred months ago.
Furthermore, now is the ideal time to clean up access. Many companies have outdated unattended access permissions or accounts belonging to former employees that are still active. Reviewing who can connect and removing anything that isn't essential drastically reduces the attack surface.
Historical perspective and company commitment
TeamViewer is no stranger to this. Over the years, it has experienced several scares, from DLL vulnerabilities in 2010 to password cracking incidents in 2020 and targeted attacks by groups like APT29 in 2024. However, the company has strengthened its security by implementing a Secure Development Lifecycle (S-SDLC) and certifications such as ISO 27001 and SOC2.
They use advanced techniques such as static and dynamic code analysis (SAST/DAST) and conduct annual penetration tests with external signatures. All their software is digitally signed by DigiCert, allowing security tools to verify that the program is authentic and has not been modified by a third party.
Keeping the software updated to version 15.82, rigorously managing remote access, and combining patching with security layers such as MFA and continuous monitoring is the only way to harness the power of TeamViewer without putting the organization's IT infrastructure at risk.