{"id":"CVE-2026-111583","kind":"vulnerability","aliases":["CVE-2026-111583"],"related":[],"title":"TeamViewer Windows installer lets local low-privilege users run commands as SYSTEM","description":"Improper access control in the installer\nstaging directory used by TeamViewer Full Client and Host prior to version\n15.82 for Windows during installation of Advanced Asset Management allows a\nlocal authenticated user with low privileges to execute arbitrary commands as\nSYSTEM. An attacker can place a crafted installer options file that is\nprocessed by the Advanced Asset Management installer during service activation.","summary":"TeamViewer Full Client and Host before 15.82 for Windows mishandle the installer staging directory during Advanced Asset Management installation. A local user with low privileges can plant a crafted installer options file that the installer processes, running arbitrary commands as SYSTEM.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["endpoints","other","teamviewer","windows"],"not_affected_if":["no-advanced-asset-management","teamviewer-fixed-version"],"how_to_check":"- Check the installed TeamViewer version on Windows hosts, e.g. in the TeamViewer About dialog or the Programs and Features list.\n- Check whether the Advanced Asset Management component is installed on the host.","fix":"- Upgrade TeamViewer Full Client and Host to `15.82` or later on Windows.\n- unknown for interim mitigations in the sources.","status":"open","published_at":"2026-10-27T16:17:29+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","triaged_at":"2026-10-27T16:34:17+00:00","updated_at":"2026-10-27T16:34:17+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-27T16:34:17Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade TeamViewer Full Client and Host to `15.82` or later on Windows.\n- unknown for interim mitigations in the sources.","reach":"local","title":"TeamViewer Windows installer lets local low-privilege users run commands as SYSTEM","impact":"high","summary":"TeamViewer Full Client and Host before 15.82 for Windows mishandle the installer staging directory during Advanced Asset Management installation. A local user with low privileges can plant a crafted installer options file that the installer processes, running arbitrary commands as SYSTEM.","category":"other","nicknames":[],"who_cares":["windows","teamviewer","endpoints"],"confidence":0.8,"needs_auth":"yes","worst_case":"Local user gains SYSTEM-level command execution on the Windows host.","analyst_note":"","how_to_check":"- Check the installed TeamViewer version on Windows hosts, e.g. in the TeamViewer About dialog or the Programs and Features list.\n- Check whether the Advanced Asset Management component is installed on the host.","needs_analyst":false,"not_affected_if":["teamviewer-fixed-version","no-advanced-asset-management"],"who_is_affected":"Windows machines running TeamViewer Full Client or Host before `15.82` where the Advanced Asset Management component was installed or activated. The attacker must already have a local account on the machine, so shared workstations and servers with multiple local users are the most exposed. Systems without TeamViewer or on a fixed version can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000613,"input_tokens":3338,"output_tokens":559,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111583':16A,19A '-2026':15A,18A '15.82':30B,83C 'access':66C 'activ':126C 'advanc':39B,89C,120C 'allow':92C 'arbitrari':61B,102C 'asset':40B,90C,121C 'attack':107C 'authent':95C 'client':26B,77C 'command':11A,62B,103C 'control':67C 'craft':52B,111C 'cve':14A,17A 'directori':37B,72C 'endpoint':20B 'execut':101C 'file':55B,114C 'full':25B,76C 'host':28B,79C 'improp':65C 'instal':3A,35B,42B,53B,58B,70C,87C,112C,123C 'let':4A 'local':5A,44B,94C 'low':7A,47B,98C 'low-privileg':6A 'manag':41B,91C,122C 'mishandl':33B 'option':54B,113C 'place':109C 'plant':50B 'prior':80C 'privileg':8A,48B,99C 'process':59B,117C 'run':10A,60B 'servic':125C 'stage':36B,71C 'system':13A,64B,105C 'teamview':1A,22B,24B,75C 'use':73C 'user':9A,45B,96C 'version':82C 'window':2A,23B,32B,85C","nicknames":[],"mitigations":[],"who_affected":"Windows machines running TeamViewer Full Client or Host before `15.82` where the Advanced Asset Management component was installed or activated. The attacker must already have a local account on the machine, so shared workstations and servers with multiple local users are the most exposed. Systems without TeamViewer or on a fixed version can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T16:17:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","cvss_by":"psirt@teamviewer.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111583","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111583","severity":null,"published_at":"2026-10-27T16:17:29+00:00","modified_at":"2026-10-27T16:17:29+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","fetched_at":"2026-10-27T16:33:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}