CVE-2026-111584— Local Privilege Escalation via Race Condition in TeamViewer Patch Management for Windows

Quick assessment

Affected

TeamViewer TeamViewer Remote - Patch Management

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 26.9.1 版本之前的 TeamViewer Remote Management - Patch Management for Windows 的安装过程中存在竞态条件漏洞。该漏洞允许具有低权限的本地已认证攻击者，通过在补丁管理激活期间将服务可执行文件替换到保护不足临时目录中，从而以提权后的权限执行任意代码。

CVSS 7.3 · High Updated Oct 27, 2026

Possible ATT&CK Techniques 2 AI

T1551.001 T1548.002 · Bypass User Account Control

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Local Privilege Escalation via Race Condition in TeamViewer Patch Management for Windows

Source: CVE Program / CVE List V5

Vulnerability Description

A race condition in the installation process of TeamViewer Remote Management - Patch Management for Windows prior to version 26.9.1 allows a local authenticated attacker with low privileges to execute arbitrary code with elevated privileges by replacing the service executable in an insufficiently protected temporary directory during Patch Management activation.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

特权管理不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
TeamViewer	TeamViewer Remote - Patch Management	0 ~ 26.9.1	-

II. Public POCs for CVE-2026-111584

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-111584

请登录查看更多情报信息。

Other References for CVE-2026-111584 (1)

https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1012/ vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-111584

Same Patch Batch · TeamViewer · 2026-10-27 · 9 CVEs total

CVE-2026-92372	8.8 HIGH	Out-of-bounds Write in TeamViewer Full Client for Linux and macOS Allows Remote Code Execu
CVE-2026-111585	8.8 HIGH	Integer Overflow in TeamViewer Remote Control Screen Decompression Leading to Heap-Based B
CVE-2026-92374	7.8 HIGH	Privilege Escalation via Insecure Package Handling in TeamViewer Full Client and Host for
CVE-2026-92375	7.8 HIGH	Local privilege escalation via improper IPC access control in TeamViewer Remote Management
CVE-2026-92376	7.8 HIGH	Local Privilege Escalation via IPC Broker Impersonation in TeamViewer Remote Management Mo
CVE-2026-92377	7.8 HIGH	Local Privilege Escalation via DLL Sideloading in TeamViewer Patch Management for Windows
CVE-2026-111582	7.3 HIGH	Local Privilege Escalation via DLL Hijacking in TeamViewer Monitoring for Windows
CVE-2026-111583	7.3 HIGH	Local Privilege Escalation during Advanced Asset Management Installation in TeamViewer Cli

IV. Related Vulnerabilities

Same vendor: TeamViewer

Same weakness: CWE-269