CVE-2026-111584

Full vulnerability record from the local CVENow database.

Description

A race condition in the installation process of TeamViewer Remote Management - Patch Management for Windows prior to version 26.9.1 allows a local authenticated attacker with low privileges to execute arbitrary code with elevated privileges by replacing the service executable in an insufficiently protected temporary directory during Patch Management activation.

Severity

HIGH

CVSS score

7.3 (v3.1)

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-10-27 16:17:29.757000

Last modified

2026-10-27 16:17:29.757000

View original CVE JSON

{
  "id": "CVE-2026-111584",
  "sourceIdentifier": "[email protected]",
  "published": "2026-10-27T16:17:29.757",
  "lastModified": "2026-10-27T16:17:29.757",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A race condition in the installation\nprocess of TeamViewer Remote Management - Patch Management for Windows prior to\nversion 26.9.1 allows a local authenticated attacker with low privileges to\nexecute arbitrary code with elevated privileges by replacing the service\nexecutable in an insufficiently protected temporary directory during Patch\nManagement activation."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "TeamViewer",
          "product": "TeamViewer Remote - Patch Management",
          "defaultStatus": "unaffected",
          "modules": [
            "RM_PatchManagement_Service.exe"
          ],
          "platforms": [
            "Windows"
          ],
          "versions": [
            {
              "version": "0",
              "lessThan": "26.9.1",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "0 (Legacy version for v14.7 client)",
              "lessThan": "24.12.5 (Legacy version for v14.7 client)",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
          "baseScore": 7.3,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.3,
        "impactScore": 5.9
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1012/",
      "source": "[email protected]"
    }
  ]
}