CVE-2026-92376: Local Privilege Escalation via IPC Broker Impersonation in TeamViewer Remote Management Monitoring for Windows
Improper authentication in the inter-process communication (IPC) mechanism of TeamViewer Remote Management Monitoring for Windows prior to version 26.10.1 allows a local authenticated attacker with low privileges to impersonate the IPC broker and cause the Monitoring service to execute arbitrary code with NT AUTHORITY\SYSTEM privileges, resulting in local privilege escalation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TeamViewer Remote Management Monitoring for Windowsto a version that resolves this vulnerability.Fixed in 26.10.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running TeamViewer Remote Management Monitoring for Windows before version 26.10.1 are affected. Exploitation requires local access by an authenticated low-privileged attacker.
What level of access can an attacker obtain?
A successful attacker can cause the Monitoring service to execute arbitrary code as NT AUTHORITY\SYSTEM. This provides full local privilege escalation on the affected Windows system.
What does an attacker need to exploit the vulnerability?
The attacker must already be able to authenticate locally with a low-privileged account. No user interaction is required.
How can the issue be remediated?
Upgrade TeamViewer Remote Management Monitoring for Windows to version 26.10.1 or later.