CVE-2026-111584 in Remote Management
Summary
by MITRE • 10/27/2026
A race condition in the installation process of TeamViewer Remote Management - Patch Management for Windows prior to version 26.9.1 allows a local authenticated attacker with low privileges to execute arbitrary code with elevated privileges by replacing the service executable in an insufficiently protected temporary directory during Patch Management activation.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified as CVE-2024-35873 represents a critical security flaw within TeamViewer Remote Management, specifically affecting the Patch Management component for Windows environments prior to version 26.9.1. This issue is classified fundamentally as a race condition occurring during the software installation and activation phase of the patch management service. The core technical deficiency lies in the handling of temporary directories used by the installer or update mechanism. When the system initiates the process of activating Patch Management, it creates or utilizes a temporary directory to stage files required for the upgrade or configuration change. However, this directory is not secured with appropriate access control lists that restrict write permissions exclusively to privileged accounts such as SYSTEM or Administrators. Instead, the directory retains default permissions that allow users with low-level privileges on the local machine to modify its contents.
This architectural oversight creates a classic privilege escalation vector known as insecure temporary file creation. A local attacker who possesses authenticated access but only standard user rights can exploit this window of opportunity during the brief interval when the installation process is writing files to or referencing these unprotected directories. By monitoring the directory for specific executable names associated with the TeamViewer service, an attacker can perform a race condition attack. They replace the legitimate service executable with their own malicious payload before the system completes its integrity checks and proceeds to register the new binary as a Windows service. Because the installation process runs with elevated privileges, it inadvertently loads and executes the attacker-controlled code under that high-privilege context.
The operational impact of this vulnerability is severe, resulting in full local privilege escalation from low-level user rights to SYSTEM level access on the affected host. Once an attacker achieves execution as SYSTEM, they gain unrestricted control over the operating system. This includes the ability to install additional malware, create new administrative accounts, dump sensitive credentials stored in memory or on disk, and pivot laterally across the network using the compromised machine as a foothold. In enterprise environments where TeamViewer is deployed for remote support and management, this vulnerability undermines the security boundary between standard user workstations and critical infrastructure components managed by the software. The attacker does not need physical access to the device if they have valid credentials or can achieve initial low-level code execution through other means such as phishing or exploiting a separate web application vulnerability.
From a threat intelligence perspective, this flaw aligns with CWE-377, which describes insecure temporary file creation, and is directly exploitable via ATT&CK technique T1059, Command and Scripting Interpreter, followed by T1068 Exploitation for Privilege Escalation. The attack path typically involves the attacker identifying the target process or service being installed, predicting the filename of the executable to be dropped in the temp directory, and using a high-speed loop to overwrite that file with malicious code at the precise moment before the system moves it into its final destination. This requires timing precision but is well-documented and frequently utilized by automated exploitation frameworks due to the predictable nature of many installer behaviors regarding temporary storage locations.
Mitigation for this vulnerability primarily involves immediate patching. Organizations running TeamViewer Remote Management Patch Management on Windows must upgrade to version 26.9.1 or later, where the developers have addressed the permission settings on the temporary directories used during installation and activation processes. Until patches are applied, administrators should consider restricting write access to common temporary folders such as %TEMP% and %TMP% for standard users if feasible within their environment policies, although this may impact other applications relying on those paths. Additionally, implementing strict application whitelisting or endpoint detection and response solutions that monitor for unexpected modifications to service binaries in system directories can help detect attempts to exploit this race condition. Regular auditing of installed software versions and ensuring timely updates are critical components of a defense-in-depth strategy against such privilege escalation vulnerabilities.