Loading story…
Multiple critical and high-severity vulnerabilities have been discovered in the TeamViewer DEX Client’s Content Distribution Service (NomadBranch.exe), affecting Windows versions prior to 25.11 and certain legacy branches. The most severe flaw, CVE-2025-44016 (CVSS 8.8), allows attackers on the local network to bypass file integrity checks and execute arbitrary code by submitting a request with a valid hash for malicious code. Additional vulnerabilities include CVE-2025-12687, which can trigger a denial-of-service (DoS) crash, and another flaw that enables the service to send sensitive data to arbitrary internal IP addresses, risking data exposure. All issues require adjacent network access, making them particularly relevant in peer-to-peer or shared LAN environments, but there is currently no evidence of exploitation in the wild.
TeamViewer has addressed these vulnerabilities in version 25.11.0.29 and released hotfixes for affected legacy branches. Organizations are advised to update to the latest versions, verify the status of the NomadBranch service, and implement network segmentation to mitigate the risk of adjacent network attacks. Installations with NomadBranch disabled by default and the TeamViewer Remote/Tensor “DEX Essentials” add-on are not affected. The disclosure highlights the importance of robust input validation and timely patch management for remote access and content distribution tools.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
TeamViewer released patches in version 25.11.0.29 and hotfixes for legacy branches to address the disclosed NomadBranch vulnerabilities. The company advised organizations to update affected systems, check whether NomadBranch is enabled, and use network segmentation to reduce risk.
Multiple vulnerabilities were identified in TeamViewer DEX Client’s Content Distribution Service (NomadBranch.exe), including CVE-2025-44016, which could let an adjacent-network attacker bypass file integrity checks and execute arbitrary code, and CVE-2025-12687 issues that could cause denial of service or expose sensitive data. The flaws affect Windows versions prior to 25.11 and certain legacy branches, with no evidence of exploitation in the wild reported.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
TeamViewer has released fixes for two high-severity Desktop Client vulnerabilities: `CVE-2026-19042`, a Linux command-injection issue, and `CVE-2026-16444`, an improper path-validation flaw. `CVE-2026-19042` can enable remote code execution after a Linux user clicks an attacker-crafted URL sent through out-of-session chat. `CVE-2026-16444` allows an authenticated participant in a remote session to use path-traversal sequences in file-transfer or virtual-file-clipboard filenames to write files outside the intended download directory. The arbitrary file-write flaw could allow attackers to place or overwrite executables, scripts, shortcuts, or configuration files and potentially execute code with the affected user's privileges. Affected deployments include TeamViewer Remote, Tensor, and ONE using vulnerable Full Client, Host, or QuickSupport components on Windows, macOS, and Linux. Organizations should update clients to version `15.81.5` or later, apply the available legacy-branch fixes, and instruct Linux users awaiting patches not to open links received through TeamViewer chat; TeamViewer reported no known public disclosure or in-the-wild exploitation before its advisory.
Aug 28, 2026
TeamViewer released fixes for five **high-severity** vulnerabilities in its Full Client and Host products for Windows, Linux, and macOS. The issues primarily affect versions earlier than `15.82` and include local privilege-escalation flaws, a heap-based buffer overflow in session-recording playback that could enable code execution, and an access-control bypass that could allow unauthorized remote actions and potentially remote code execution. The Canadian Centre for Cyber Security issued advisory `AV26-977` urging organizations to review TeamViewer’s security bulletins and apply available updates. TeamViewer said version `15.82`, along with specified maintenance and legacy releases, remediates the flaws; it reported no known public disclosure or active exploitation at the time of publication. Organizations should prioritize updating TeamViewer endpoints, especially systems that permit unattended remote access or use session recording.
Sep 29, 2026
A series of critical and high-severity vulnerabilities have been disclosed affecting a wide range of software products, including network devices, workflow automation platforms, document management systems, and developer tools. Notable issues include command injection flaws in TRENDnet TEW-800MB routers (CVE-2025-15136, CVE-2025-15137), remote code execution vulnerabilities in Xspeeder SXZOS (CVE-2025-54322), Eigent (CVE-2025-68952), StreamVault (CVE-2025-66203), n8n (CVE-2025-68668), and Yealink T21P_E2 phones (CVE-2025-66738). Additional vulnerabilities involve authentication bypasses in IBM API Connect (CVE-2025-13915) and Eaton UPS Companion (CVE-2025-59887), a session token capture flaw in M-Files Server (CVE-2025-13008), prototype pollution in apidoc-core (CVE-2025-13158), and a blind SQL injection in Cloudlog (CVE-2024-44065). Several of these vulnerabilities allow for remote exploitation, with some exploits already publicly available. Vendors have responded with patches for many of the affected products, such as Eigent, StreamVault, lmdeploy, and n8n, while some issues remain with public exploits and no vendor response, as seen with TRENDnet. The vulnerabilities present risks ranging from arbitrary code execution and privilege escalation to unauthorized access and data exposure. Organizations using the affected products are strongly advised to review the relevant advisories, apply available patches, and implement recommended mitigations to reduce the risk of exploitation. The diversity and severity of these vulnerabilities underscore the importance of timely vulnerability management and monitoring for emerging threats across the software supply chain.
Jun 29, 2026