CVE-2026-111584: Local Privilege Escalation via Race Condition in TeamViewer Patch Management for Windows
A race condition in the installation process of TeamViewer Remote Management - Patch Management for Windows prior to version 26.9.1 allows a local authenticated attacker with low privileges to execute arbitrary code with elevated privileges by replacing the service executable in an insufficiently protected temporary directory during Patch Management activation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TeamViewer Remote Management - Patch Management for Windowsto a version that resolves this vulnerability.Fixed in 26.9.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Windows systems running TeamViewer Remote Management - Patch Management before version 26.9.1 are exposed during Patch Management activation. Exploitation requires a local authenticated account with low privileges.
What does an attacker need to do to exploit it?
The attacker must win a race during Patch Management activation and replace the service executable in an insufficiently protected temporary directory. Successful exploitation can result in arbitrary code execution with elevated privileges.
Does this require user interaction or remote access?
The attack is local and requires an authenticated low-privileged attacker. The supplied severity vector indicates user interaction is required.
What is the immediate remediation?
Update TeamViewer Remote Management - Patch Management for Windows to version 26.9.1 or later.