---
id: "CVE-2026-92375"
kind: "vulnerability"
aliases: ["CVE-2026-92375"]
title: "TeamViewer: local low-privilege user can run scripts as SYSTEM"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["endpoints", "other", "remote-management", "teamviewer", "windows"]
not_affected_if: ["no-local-untrusted-users"]
published_at: "2026-10-27T16:17:31+00:00"
first_seen_at: "2026-10-27T16:33:07+00:00"
updated_at: "2026-10-27T16:34:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92375", "first_seen_at": "2026-10-27T16:33:07+00:00"}]
---

# TeamViewer: local low-privilege user can run scripts as SYSTEM

TeamViewer Full Client or Host before 15.83, paired with the Remote Management Monitoring component before 26.10.1, has an access control flaw in their inter-process communication. A local user with low privileges can make it execute scripts as SYSTEM (root on non-Windows).

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed TeamViewer Full Client or Host version in the About dialog or on the Windows program list; a build below `15.83` is affected.
- Check the installed Remote Management Monitoring component version; a build below `26.10.1` is affected.

## Fix

- Update TeamViewer Full Client or Host to `15.83` or later.
- Update the Remote Management Monitoring component to `26.10.1` or later.

## Timeline

- 2026-10-27T16:33:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92375

## From the sources

An improper access control vulnerability in
the IPC communication between TeamViewer Full Client or Host prior to version
15.83 and the Remote Management Monitoring component prior to version 26.10.1
allows a local authenticated attacker with low privileges to execute scripts as
SYSTEM/root.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_