High severity · published Oct 27, 2026
CVE-2026-111584
Local Privilege Escalation via Race Condition in TeamViewer Patch Management for Windows
New
7.3
CVSS
–
EPSS
No
On KEV
Description
A race condition in the installation
process of TeamViewer Remote Management - Patch Management for Windows prior to
version 26.9.1 allows a local authenticated attacker with low privileges to
execute arbitrary code with elevated privileges by replacing the service
executable in an insufficiently protected temporary directory during Patch
Management activation.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TR
TeamViewer Remote - Patch Management · TeamViewer
before 26.9.1; 0 (Legacy version for v14.7 client) before 24.12.5 (Legacy version for v14.7 client) · source: vendor
Affected product
TR
TeamViewer Remote - Patch Management
TeamViewer