Medium severity · published May 13, 2026
CVE-2026-2695
Lack of Server-side validation in Instruction Input in TeamViewer DEX Platform (On-Premises)
6.3
CVSS
0.2%
EPSS
No
On KEV
Description
A command
injection vulnerability was discovered in TeamViewer DEX Platform On-Premises
(former 1E DEX Platform On-Premises) prior to version 9.2. Improper input validation allows
authenticated users with at least questioner privileges to inject commands in specific
instructions. Exploitation could lead to execution of elevated commands on
devices connected to the platform.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
DEX (On-Premises) · TeamViewer
before 9.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-2695
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-2695
www.teamviewer.com
https://www.teamviewer.com/de/resources/trust-center/security-bulletins/tv-2026-1004/
More from DEX (On-Premises)
5.4
CVE-2026-8381
Broken Access Control in TeamViewer DEX Platform (On Premises)