What is the CVSS score of EUVD-2026-30056?

EUVD-2026-30056 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Is there a patch available for EUVD-2026-30056?

Yes, a patch is available for EUVD-2026-30056. Update the affected software to the latest version immediately.

TeamViewer DEX Platform EUVD-2026-30056

| CVE-2026-2695 MEDIUM

Improper Input Validation (CWE-20)

2026-05-13 psirt@teamviewer.com

GHSA-567r-vw5w-g2q6

Code Injection

6.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 10:42 vuln.today

Patch available

May 13, 2026 - 18:03 EUVD

DescriptionCVE.org

A command injection vulnerability was discovered in TeamViewer DEX Platform On-Premises (former 1E DEX Platform On-Premises) prior to version 9.2. Improper input validation allows authenticated users with at least questioner privileges to inject commands in specific instructions. Exploitation could lead to execution of elevated commands on devices connected to the platform.

AnalysisAI

Command injection in TeamViewer DEX Platform On-Premises (formerly 1E DEX Platform On-Premises) prior to version 9.2 allows authenticated low-privileged users to execute elevated commands on endpoints managed by the platform. The vulnerability stems from improper input validation (CWE-20) within specific platform instructions, enabling a user holding only 'questioner' privileges to escalate their effective impact to arbitrary command execution on connected devices. No public exploit exists and EPSS is low (0.08%), though SSVC rates Technical Impact as 'total', reflecting the downstream risk to managed endpoints despite the bounded CVSS partial-impact scores.

Technical ContextAI

TeamViewer DEX Platform On-Premises (EUVD-2026-30056) is an enterprise endpoint management and digital employee experience platform, formerly marketed as 1E DEX Platform. The vulnerability is classified under CWE-20 (Improper Input Validation), a root cause where attacker-controlled input reaches a command execution context without adequate sanitization or allowlisting. Affected versions span all releases from 0 up to but not including 9.2, per EUVD CPE data ('DEX (On-Premises) 0 <9.2'). The injection occurs within 'specific instructions' - a platform feature that dispatches commands or queries to managed endpoint devices - meaning the injection payload propagates beyond the platform itself onto connected hosts. The CVSS vector AV:N/AC:L/PR:L/UI:N reflects network-accessible exploitation requiring only low-level credentials with no interaction from other users.

RemediationAI

Upgrade TeamViewer DEX Platform On-Premises to version 9.2 or later, which resolves the improper input validation issue per the vendor advisory at https://www.teamviewer.com/de/resources/trust-center/security-bulletins/tv-2026-1004/. The patched version is confirmed by EUVD affected version data ('DEX (On-Premises) 0 <9.2'). If immediate upgrade is not possible, restrict 'questioner' role assignment to only trusted, vetted users as a compensating control - note this reduces platform utility if questioner access is broad. Additionally, review audit logs for anomalous instruction execution patterns, particularly those targeting elevated command contexts on connected devices. Network-level restriction of access to the DEX Platform management interface to specific IP ranges or VPN segments can reduce the attack surface given the network (AV:N) attack vector, though it does not eliminate risk from already-authenticated internal users.