Loading story…
TeamViewer has released fixes for two high-severity Desktop Client vulnerabilities: CVE-2026-19042, a Linux command-injection issue, and CVE-2026-16444, an improper path-validation flaw. CVE-2026-19042 can enable remote code execution after a Linux user clicks an attacker-crafted URL sent through out-of-session chat. CVE-2026-16444 allows an authenticated participant in a remote session to use path-traversal sequences in file-transfer or virtual-file-clipboard filenames to write files outside the intended download directory.
The arbitrary file-write flaw could allow attackers to place or overwrite executables, scripts, shortcuts, or configuration files and potentially execute code with the affected user's privileges. Affected deployments include TeamViewer Remote, Tensor, and ONE using vulnerable Full Client, Host, or QuickSupport components on Windows, macOS, and Linux. Organizations should update clients to version 15.81.5 or later, apply the available legacy-branch fixes, and instruct Linux users awaiting patches not to open links received through TeamViewer chat; TeamViewer reported no known public disclosure or in-the-wild exploitation before its advisory.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
TeamViewer published security bulletin TV-2026-1008 addressing CVE-2026-16444, an improper file-path validation flaw that lets an authenticated remote-session participant use file transfer or the virtual clipboard to write files outside the intended directory. The company recommended updating affected Desktop Client components and stated it knew of no prior public disclosure or in-the-wild exploitation.
TeamViewer released updates for CVE-2026-19042, a high-severity command-injection vulnerability affecting TeamViewer Full Client and Host for Linux. An attacker could send a crafted URL in a TeamViewer chat message and execute commands in the victim user's context if the recipient clicked it; version 15.81.5 and later fixes the issue.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
heise.de
Open sourcecybersecuritynews.com
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
TeamViewer released fixes for five **high-severity** vulnerabilities in its Full Client and Host products for Windows, Linux, and macOS. The issues primarily affect versions earlier than `15.82` and include local privilege-escalation flaws, a heap-based buffer overflow in session-recording playback that could enable code execution, and an access-control bypass that could allow unauthorized remote actions and potentially remote code execution. The Canadian Centre for Cyber Security issued advisory `AV26-977` urging organizations to review TeamViewer’s security bulletins and apply available updates. TeamViewer said version `15.82`, along with specified maintenance and legacy releases, remediates the flaws; it reported no known public disclosure or active exploitation at the time of publication. Organizations should prioritize updating TeamViewer endpoints, especially systems that permit unattended remote access or use session recording.
Sep 29, 2026
Multiple critical and high-severity vulnerabilities have been discovered in the TeamViewer DEX Client’s Content Distribution Service (`NomadBranch.exe`), affecting Windows versions prior to 25.11 and certain legacy branches. The most severe flaw, CVE-2025-44016 (CVSS 8.8), allows attackers on the local network to bypass file integrity checks and execute arbitrary code by submitting a request with a valid hash for malicious code. Additional vulnerabilities include CVE-2025-12687, which can trigger a denial-of-service (DoS) crash, and another flaw that enables the service to send sensitive data to arbitrary internal IP addresses, risking data exposure. All issues require adjacent network access, making them particularly relevant in peer-to-peer or shared LAN environments, but there is currently no evidence of exploitation in the wild. TeamViewer has addressed these vulnerabilities in version 25.11.0.29 and released hotfixes for affected legacy branches. Organizations are advised to update to the latest versions, verify the status of the NomadBranch service, and implement network segmentation to mitigate the risk of adjacent network attacks. Installations with NomadBranch disabled by default and the TeamViewer Remote/Tensor “DEX Essentials” add-on are not affected. The disclosure highlights the importance of robust input validation and timely patch management for remote access and content distribution tools.
Jun 29, 2026
Multiple vulnerabilities in **TrueConf Server** were disclosed as affecting Windows deployments, including a **high-severity authentication bypass** tracked as `BDU:2025-10114`. The flaw stems from an alternative path or channel weakness (`CWE-228`) that allows remote attackers to send certain API requests without proper authentication, including access to some `/admin/*` endpoints where authorization checks are not correctly enforced. Russian vulnerability records state the issue affects multiple versions before vendor-fixed releases, that **exploit code exists**, and that the vulnerability has been **observed in attacks**. A related TrueConf Server issue, `BDU:2025-10115`, allows attackers to **read arbitrary files** on affected systems, expanding the risk from unauthorized administrative access to potential exposure of sensitive local data. Positive Technologies flagged both `BDU:2025-10114` and `BDU:2025-10115` as **trending vulnerabilities**, while a third identifier, `BDU:2025-10116`, was also listed without public technical details. The vendor has confirmed the disclosed issues and recommends applying the latest software updates and following official remediation guidance.
Jun 29, 2026