TeamViewer Remote Management Monitoring EUVD-2026-111076

Requires that TeamViewer Remote Management Monitoring for Windows (version prior to 26.10.1) is installed and its Monitoring service is running on the target host, AND that the attacker already holds a local, authenticated low-privilege session on that host (PR:L, AV:L). The specific IPC impersonation against the broker is the trigger per the description. Limiting factors: exploitation is not remotely reachable (local only), requires prior authentication at low privilege, and only affects systems with the Remote Management Monitoring component deployed - base TeamViewer remote-access installs without the Monitoring module are not indicated as affected by the provided data.

This is a credible but non-emergency local privilege escalation issue. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms it requires local access and existing low-privilege authentication, which inherently caps remote mass-exploitation potential - an attacker must already have a foothold on the host. Impact is severe once that foothold exists (C:H/I:H/A:H, escalation to NT AUTHORITY\SYSTEM), justifying the 7.8 (HIGH) base score. No EPSS score is provided, so statistical exploitation likelihood cannot be quantified. The vulnerability is NOT in CISA KEV and no POC or exploit reference is supplied, so exploitation status is: no public exploit identified at time of analysis. The vuln.today decision label is 'this_week', which aligns with a patch-available local EoP rather than an act_now/emergency item. Net: this is a legitimate patch priority for TeamViewer RMM Monitoring hosts (local EoP is valuable in post-compromise chains), but it is not a widespread remote-exploitation emergency. The 'RCE' tag in the input is misleading - the CVSS attack vector is explicitly Local (AV:L), so this is local arbitrary-code-execution for privilege escalation, not network-reachable RCE.

An attacker who already has a low-privileged authenticated session on a Windows host running TeamViewer Remote Management Monitoring (e.g., a standard user or a compromised low-privilege account) abuses the improperly authenticated IPC mechanism to impersonate the IPC broker. By doing so they coerce the Monitoring service into executing attacker-controlled code as NT AUTHORITY\SYSTEM, achieving full local privilege escalation. No public exploit code has been identified in the provided sources, and the specific technical trigger for the IPC impersonation is not described in the available sources.