TeamViewer Remote Management EUVD-2026-111080

Requires the TeamViewer Remote Management Patch Management module to be installed on a Windows host, and a low-privileged but authenticated local user already present on that host (AV:L, PR:L). Exploitation hinges on a Patch Management activation event occurring (UI:R - an operator/admin triggers activation), during which the service executable is staged in an insufficiently protected temporary directory; the attacker must win a race to overwrite that executable before it launches with elevated privileges. Limiting factors: no remote or unauthenticated path, dependence on the activation event, and the timing window inherent to the race condition, all of which constrain real-world exploitability below the raw 7.3 score. Versions prior to 26.9.1 (and legacy prior to 24.12.5 for the v14.7 client) are affected.

This is a local privilege-escalation flaw (CWE-269) with a moderate CVSS of 7.3; the input vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H confirms local attack vector, low-privilege (authenticated) attacker, and required user interaction, yielding full confidentiality/integrity/availability impact once exploited. The signals are internally consistent and point to a real but non-emergency issue: there is no CISA KEV listing and no public exploit or PoC reference in the provided data, so there is no evidence of active exploitation or weaponization. No EPSS score was supplied, so exploitation probability cannot be quantified from this data. The vendor-fed priority is 'this_week' (not act_now/emergency), which matches the profile of a patchable local EoP rather than a mass-exploited remote bug. One nuance worth verifying: the description frames the flaw as a race condition, which typically narrows the practical attack window and raises real-world exploitation difficulty beyond what the input's AC:L implies - see the assessed vector below. Overall this is a legitimate patch-this-cycle item for hosts running the TeamViewer Patch Management module, not a drop-everything incident.

A low-privileged local user on a Windows host running TeamViewer Remote Management Patch Management waits for (or induces) a Patch Management activation, then races to replace the service executable staged in an insufficiently protected temporary directory before it is launched with elevated privileges. Winning the race causes the attacker-supplied binary to execute as the elevated service account, giving full local privilege escalation. No public exploit or PoC is identified in the provided data, and the attack requires local access plus the activation event (user interaction).