TeamViewer EUVD-2026-50360

Exploitation requires that the target macOS host runs TeamViewer Full Client or Host below 15.80 with the Unattended Access feature enabled and the 2FA 'Connections approval' control configured - these are the exact product features named in the advisory. The attacker must already be authenticated with high privileges (CVSS PR:H), i.e. hold valid privileged access to the relevant TeamViewer account/device rather than acting anonymously. Limiting factors that constrain realistic risk: high attack complexity (AC:H) meaning the unenforced approval path is not trivially triggered, the requirement that Unattended Access be turned on (non-universal configuration), platform is limited to macOS builds, and the pre-existing high-privilege authentication requirement. No end-user interaction is required (UI:N).

The vendor CVSS is 8.0 (High) with vector AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H, meaning network-reachable but requiring high existing privileges and high attack complexity, with a scope change and full CIA impact once achieved. The PR:H and AC:H metrics materially reduce real-world risk: this is not an unauthenticated remote takeover but a control-bypass that presupposes the attacker already holds significant access/credentials to the TeamViewer account or device. No EPSS score, no SSVC decision, and no KEV/POC signal were provided, so exploitation is neither confirmed active nor demonstrated publicly. Net assessment: a legitimately high-severity defense-in-depth failure - the 2FA that customers rely on can be defeated - but the elevated privilege and complexity prerequisites make it a targeted-abuse risk rather than a mass-exploitation candidate. Note the tension worth verifying: AV:N with S:C and full CIA implies a powerful outcome, yet PR:H means the attacker must already be well-positioned, so the practical threat is insider or credential-compromise scenarios more than opportunistic internet scanning.

An attacker who has already obtained privileged access to a TeamViewer account or a trusted device (for example via credential theft or an insider) targets a macOS host configured for Unattended Access with 2FA connection-approval enabled. By exploiting the business-logic flaw in the approval flow, the attacker connects without satisfying the second factor and gains interactive remote control of the Mac. No public proof-of-concept has been identified, and the high attack complexity (AC:H) means the attacker must reliably trigger the specific unenforced code path.