{"schema":"threatline.record/2","record":{"id":"CVE-2026-92370","aliases":[],"summary":"Remote Session Access Control Bypass Leading to Remote Code Execution","details":"An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. By modifying access control parameters for restricted features, an attacker can perform actions that were explicitly denied by the victim's configuration. This may result in unauthorized actions and potentially lead to remote code execution on the target system.","categories":["Unclassified"],"product":"Full Client","vendor":"TeamViewer","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-92370","source_modified_at":"2026-09-30T15:28:18.681Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Full Client","vendor":"TeamViewer","versions":[{"status":"affected","version":"15.0","lessThan":"15.82","versionType":"custom"},{"status":"affected","version":"15.64.0 (Legacy Windows 7 & 8)","lessThan":"15.64.8 (Legacy Windows 7 & 8)","versionType":"custom"},{"status":"affected","version":"14.7.0 (Windows)","lessThan":"14.7.48855 (Windows)","versionType":"custom"},{"status":"affected","version":"13.2.0 (Windows)","lessThan":"13.2.36230 (Windows)","versionType":"custom"},{"status":"affected","version":"14.7.0 (Linux)","lessThan":"14.7.48855 (Linux)","versionType":"custom"},{"status":"affected","version":"13.2.0 (Linux)","lessThan":"13.2.153995 (Linux)","versionType":"custom"},{"status":"affected","version":"14.7.0 (MacOS)","lessThan":"14.7.48855 (MacOS)","versionType":"custom"},{"status":"affected","version":"13.2.0 (MacOS)","lessThan":"13.2.153994 (MacOS)","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-92370","source_modified_at":"2026-09-30T15:28:18.681Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Host","vendor":"TeamViewer","versions":[{"status":"affected","version":"15.0","lessThan":"15.82","versionType":"custom"},{"status":"affected","version":"15.64.0 (Legacy Windows 7 & 8)","lessThan":"15.64.8 (Legacy Windows 7 & 8)","versionType":"custom"},{"status":"affected","version":"14.7.0 (Windows)","lessThan":"14.7.48855 (Windows)","versionType":"custom"},{"status":"affected","version":"13.2.0 (Windows)","lessThan":"13.2.36230 (Windows)","versionType":"custom"},{"status":"affected","version":"14.7.0 (Linux)","lessThan":"14.7.48855 (Linux)","versionType":"custom"},{"status":"affected","version":"13.2.0 (Linux)","lessThan":"13.2.153995 (Linux)","versionType":"custom"},{"status":"affected","version":"14.7.0 (MacOS)","lessThan":"14.7.48855 (MacOS)","versionType":"custom"},{"status":"affected","version":"13.2.0 (MacOS)","lessThan":"13.2.153994 (MacOS)","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-92370","source_modified_at":"2026-09-30T15:28:18.681Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Full Client","ecosystem":null},"version":"15.82","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-92370","source_modified_at":"2026-09-30T15:28:18.681Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Full Client","ecosystem":null},"version":"15.64.8 (Legacy Windows 7 & 8)","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-92370","source_modified_at":"2026-09-30T15:28:18.681Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Full Client","ecosystem":null},"version":"14.7.48855 (Windows)","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-92370","source_modified_at":"2026-09-30T15:28:18.681Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Full Client","ecosystem":null},"version":"13.2.36230 (Windows)","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-92370","source_modified_at":"2026-09-30T15:28:18.681Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Full Client","ecosystem":null},"version":"14.7.48855 (Linux)","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-92370","source_modified_at":"2026-09-30T15:28:18.681Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Full Client","ecosystem":null},"version":"13.2.153995 (Linux)","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-92370","source_modified_at":"2026-09-30T15:28:18.681Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Full Client","ecosystem":null},"version":"14.7.48855 (MacOS)","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-92370","source_modified_at":"2026-09-30T15:28:18.681Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Full Client","ecosystem":null},"version":"13.2.153994 (MacOS)","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-92370","source_modified_at":"2026-09-30T15:28:18.681Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Host","ecosystem":null},"version":"15.82","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-92370","source_modified_at":"2026-09-30T15:28:18.681Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Host","ecosystem":null},"version":"15.64.8 (Legacy Windows 7 & 8)","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-92370","source_modified_at":"2026-09-30T15:28:18.681Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Host","ecosystem":null},"version":"14.7.48855 (Windows)","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-92370","source_modified_at":"2026-09-30T15:28:18.681Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Host","ecosystem":null},"version":"13.2.36230 (Windows)","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-92370","source_modified_at":"2026-09-30T15:28:18.681Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Host","ecosystem":null},"version":"14.7.48855 (Linux)","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-92370","source_modified_at":"2026-09-30T15:28:18.681Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Host","ecosystem":null},"version":"13.2.153995 (Linux)","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-92370","source_modified_at":"2026-09-30T15:28:18.681Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Host","ecosystem":null},"version":"14.7.48855 (MacOS)","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-92370","source_modified_at":"2026-09-30T15:28:18.681Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Host","ecosystem":null},"version":"13.2.153994 (MacOS)","basis":"first unaffected version stated in the CVE record"}],"cvss":8.8,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00375,"percentile":0.3025,"score_date":"2026-10-23"},"published_at":"2026-09-29T15:42:27.283Z","modified_at":"2026-09-30T15:28:18.681Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-92370","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-09-30T15:28:18.681Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92370","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1010/","tags":["vendor-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-09-30T15:12:37.475626Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-09-30T15:28:18.681Z","content_hash":"9204bff212346a8b17433fea8d5d6ab5aa25baf1f7b6722d9defec4bc30f207c"}}