{"id":"CVE-2026-92376","kind":"vulnerability","aliases":["CVE-2026-92376"],"related":[],"title":"TeamViewer Remote Management: IPC flaw lets local user gain SYSTEM","description":"Improper authentication in the\ninter-process communication (IPC) mechanism of TeamViewer Remote Management\nMonitoring for Windows prior to version 26.10.1 allows a local authenticated\nattacker with low privileges to impersonate the IPC broker and cause the\nMonitoring service to execute arbitrary code with NT AUTHORITY\\SYSTEM\nprivileges, resulting in local privilege escalation.","summary":"TeamViewer Remote Management Monitoring for Windows before 26.10.1 has an authentication flaw in its inter-process communication mechanism. A local user with low privileges can impersonate the IPC broker and make the Monitoring service run arbitrary code as NT AUTHORITY\\SYSTEM.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["endpoint-management","other","teamviewer","windows"],"not_affected_if":["component-not-installed"],"how_to_check":"- Check the installed TeamViewer Remote Management Monitoring version on Windows endpoints; versions below `26.10.1` are in scope\n- unknown for other checks, as the sources do not say","fix":"- Upgrade TeamViewer Remote Management Monitoring to `26.10.1` or later\n- unknown for interim mitigations, as the sources do not say","status":"open","published_at":"2026-10-27T16:17:32+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","triaged_at":"2026-10-27T16:34:08+00:00","updated_at":"2026-10-27T16:34:08+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-27T16:34:08Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade TeamViewer Remote Management Monitoring to `26.10.1` or later\n- unknown for interim mitigations, as the sources do not say","reach":"local","title":"TeamViewer Remote Management: IPC flaw lets local user gain SYSTEM","impact":"high","summary":"TeamViewer Remote Management Monitoring for Windows before 26.10.1 has an authentication flaw in its inter-process communication mechanism. A local user with low privileges can impersonate the IPC broker and make the Monitoring service run arbitrary code as NT AUTHORITY\\SYSTEM.","category":"other","nicknames":[],"who_cares":["windows","teamviewer","endpoint-management"],"confidence":0.8,"needs_auth":"yes","worst_case":"Local low-privilege user runs arbitrary code as SYSTEM on Windows","analyst_note":"Confirm the affected version range and whether a vendor advisory or patch notes exist; the NVD entry alone gives no mitigation guidance.","how_to_check":"- Check the installed TeamViewer Remote Management Monitoring version on Windows endpoints; versions below `26.10.1` are in scope\n- unknown for other checks, as the sources do not say","needs_analyst":true,"not_affected_if":["component-not-installed"],"who_is_affected":"Windows machines running TeamViewer Remote Management Monitoring before `26.10.1` are exposed, since any local account with low privileges can escalate to SYSTEM. Teams that manage endpoints through TeamViewer Remote Management should look at those agents. Machines without the Monitoring component installed are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000638,"input_tokens":3354,"output_tokens":605,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-92376':13A,16A '26.10.1':30B,85C 'allow':86C 'arbitrari':59B,106C 'attack':90C 'authent':33B,66C,89C 'author':63B,110C 'broker':52B,98C 'caus':100C 'code':60B,107C 'communic':40B,72C 'cve':11A,14A 'endpoint':18B 'endpoint-manag':17B 'escal':117C 'execut':105C 'flaw':5A,34B 'gain':9A 'imperson':49B,95C 'improp':65C 'inter':38B,70C 'inter-process':37B,69C 'ipc':4A,51B,73C,97C 'let':6A 'local':7A,43B,88C,115C 'low':46B,92C 'make':54B 'manag':3A,19B,25B,78C 'mechan':41B,74C 'monitor':26B,56B,79C,102C 'nt':62B,109C 'prior':82C 'privileg':47B,93C,112C,116C 'process':39B,71C 'remot':2A,24B,77C 'result':113C 'run':58B 'servic':57B,103C 'system':10A,64B,111C 'teamview':1A,21B,23B,76C 'user':8A,44B 'version':84C 'window':22B,28B,81C","nicknames":[],"mitigations":[],"who_affected":"Windows machines running TeamViewer Remote Management Monitoring before `26.10.1` are exposed, since any local account with low privileges can escalate to SYSTEM. Teams that manage endpoints through TeamViewer Remote Management should look at those agents. Machines without the Monitoring component installed are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T16:17:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@teamviewer.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92376","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92376","severity":null,"published_at":"2026-10-27T16:17:32+00:00","modified_at":"2026-10-27T16:17:32+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","fetched_at":"2026-10-27T16:33:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}