All vulnerabilities
CVE-2026-111584

Local Privilege Escalation via Race Condition in TeamViewer Patch Management for Windows

TeamViewer TeamViewer Remote - Patch Management
Open in ThreatlineRecord JSON
CVSS
7.3High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in26.9.1Also 24.12.5 (Legacy version for v14.7 client)CVE List
Published27 Oct 2026Updated 27 Oct 2026CVE List

What fixes it

  • 26.9.1TeamViewer Remote - Patch ManagementCVE List
  • 24.12.5 (Legacy version for v14.7 client)TeamViewer Remote - Patch ManagementCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

A race condition in the installation process of TeamViewer Remote Management - Patch Management for Windows prior to version 26.9.1 allows a local authenticated attacker with low privileges to execute arbitrary code with elevated privileges by replacing the service executable in an insufficiently protected temporary directory during Patch Management activation.

Text from CVE List

Affected versions 2

  • TeamViewer Remote - Patch Managementaffected: all versions before 26.9.1CVE List
  • TeamViewer Remote - Patch Managementaffected: 0 (Legacy version for v14.7 client) before 24.12.5 (Legacy version for v14.7 client)CVE List

References 1