Medium severity · published Jan 29, 2026
CVE-2026-23566
Log Injection in Content Distribution Service UDP Handler
6.5
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an attacker on the adjacent network to inject, tamper with, or forge log entries in \Nomad Branch.log via crafted data sent to the UDP network handler. This can impact log integrity and nonrepudiation.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DE
DEX · TeamViewer
before 26.1 · source: vendor
DE
Digital Employee Experience · Teamviewer
before 26.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-23566
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-23566
Vendor Advisory
https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1001/
More from DEX
8.8
CVE-2025-44016
File Hash Validation Bypass in NomadBranch.exe
8.1
CVE-2026-23568
Out-of-bounds read vulnerability in Content Distribution Service
7.5
CVE-2026-23569
Out-of-bounds read vulnerability in Content Distribution Service
7.2
CVE-2025-64993
Command Injection in 1E-ConfigMgrConsoleExtensions Instructions
7.2
CVE-2025-64992
Command Injection in 1E-Nomad-PauseNomadJobQueue Instruction