Loading story…
TeamViewer released fixes for five high-severity vulnerabilities in its Full Client and Host products for Windows, Linux, and macOS. The issues primarily affect versions earlier than 15.82 and include local privilege-escalation flaws, a heap-based buffer overflow in session-recording playback that could enable code execution, and an access-control bypass that could allow unauthorized remote actions and potentially remote code execution.
The Canadian Centre for Cyber Security issued advisory AV26-977 urging organizations to review TeamViewer’s security bulletins and apply available updates. TeamViewer said version 15.82, along with specified maintenance and legacy releases, remediates the flaws; it reported no known public disclosure or active exploitation at the time of publication. Organizations should prioritize updating TeamViewer endpoints, especially systems that permit unattended remote access or use session recording.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security issued advisory AV26-977 concerning multiple vulnerabilities affecting TeamViewer Full Client and Host on Windows, Linux, and macOS. It advised users and administrators to review TeamViewer security information and apply available updates.
TeamViewer released updates for five high-severity flaws affecting TeamViewer Full Client, Host, and related modules, including local privilege-escalation, session-recording buffer-overflow, and access-control-bypass issues. The company recommended updating to version 15.82 or the latest supported release and stated it knew of no public disclosure or active exploitation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourceteamviewer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
TeamViewer has released fixes for two high-severity Desktop Client vulnerabilities: `CVE-2026-19042`, a Linux command-injection issue, and `CVE-2026-16444`, an improper path-validation flaw. `CVE-2026-19042` can enable remote code execution after a Linux user clicks an attacker-crafted URL sent through out-of-session chat. `CVE-2026-16444` allows an authenticated participant in a remote session to use path-traversal sequences in file-transfer or virtual-file-clipboard filenames to write files outside the intended download directory. The arbitrary file-write flaw could allow attackers to place or overwrite executables, scripts, shortcuts, or configuration files and potentially execute code with the affected user's privileges. Affected deployments include TeamViewer Remote, Tensor, and ONE using vulnerable Full Client, Host, or QuickSupport components on Windows, macOS, and Linux. Organizations should update clients to version `15.81.5` or later, apply the available legacy-branch fixes, and instruct Linux users awaiting patches not to open links received through TeamViewer chat; TeamViewer reported no known public disclosure or in-the-wild exploitation before its advisory.
Aug 28, 2026
Multiple critical and high-severity vulnerabilities have been discovered in the TeamViewer DEX Client’s Content Distribution Service (`NomadBranch.exe`), affecting Windows versions prior to 25.11 and certain legacy branches. The most severe flaw, CVE-2025-44016 (CVSS 8.8), allows attackers on the local network to bypass file integrity checks and execute arbitrary code by submitting a request with a valid hash for malicious code. Additional vulnerabilities include CVE-2025-12687, which can trigger a denial-of-service (DoS) crash, and another flaw that enables the service to send sensitive data to arbitrary internal IP addresses, risking data exposure. All issues require adjacent network access, making them particularly relevant in peer-to-peer or shared LAN environments, but there is currently no evidence of exploitation in the wild. TeamViewer has addressed these vulnerabilities in version 25.11.0.29 and released hotfixes for affected legacy branches. Organizations are advised to update to the latest versions, verify the status of the NomadBranch service, and implement network segmentation to mitigate the risk of adjacent network attacks. Installations with NomadBranch disabled by default and the TeamViewer Remote/Tensor “DEX Essentials” add-on are not affected. The disclosure highlights the importance of robust input validation and timely patch management for remote access and content distribution tools.
Jun 29, 2026
Several major software vendors, including Mozilla, Node.js, SonicWall, Cisco, Google, Apple, Ubuntu, Red Hat, VMware, and TeamViewer, have disclosed security vulnerabilities affecting a wide range of products. These advisories highlight issues such as OS command injection in the Node.js `systeminformation` library, privilege escalation in SonicWall SMA1000, improper input validation in Cisco Secure Email Gateway, and multiple vulnerabilities in browsers like Firefox and Chrome. Additionally, Apple products, Epson printers, and TeamViewer DEX Client have been identified as having critical security flaws, with some advisories noting the potential for remote code execution or privilege escalation if left unpatched. Security agencies and vendors are urging users and administrators to review the relevant advisories and apply patches or mitigations as soon as possible. The vulnerabilities span operating systems (Linux kernel in Ubuntu and Red Hat), cloud and virtualization platforms (VMware Tanzu), and widely used remote access tools (TeamViewer). The breadth of affected products underscores the importance of timely updates and vigilance in monitoring official security channels for new disclosures and remediation guidance.
Jun 29, 2026