CVE-2026-92371

Think of this like a security badge system where, in the split second between scanning a badge and opening a door, someone could swap which door actually opens. A regular employee-level user on these Linux machines can exploit that tiny timing gap to get the system to open or change files it shouldn't, effectively letting them take over the whole machine.

This matters to you if you run TeamViewer Full Client or Host on Linux systems, particularly where the Cloud Session Recording feature is used. It only matters if someone already has a regular (non-admin) account on that machine — an outside attacker with no access at all cannot use this flaw directly.

This is a high-severity flaw that can hand a regular logged-in user full control of the machine, and it works in the default configuration without any extra user action. While there's no confirmed report yet of attackers actively using it, the severity and ease of triggering it mean you should treat this as urgent and not wait to patch.

Confirm exposure by inventorying all Linux hosts running TeamViewer Full Client or Host, checking installed version against 15.82. Any version prior to 15.82 is vulnerable to this TOCTOU-style path validation race condition in the Cloud Session Recording component (CWE-59). Upgrade both Full Client and Host to 15.82 or later across all Linux deployments — there is no documented breaking-change concern noted by the vendor beyond the standard update process. As a temporary mitigation if patching must be delayed, restrict or disable local account creation/access on affected hosts and disable Cloud Session Recording where feasible to reduce the attack surface, since exploitation requires an existing low-privileged local session. No CISA KEV listing exists for this CVE, so there is no federal remediation deadline. Monitor vendor advisories for any update to exploitation status, and monitor for unexpected privilege changes or file modifications on hosts still running pre-15.82 builds.

CVSS 3.1 score 7.0 (High): AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H — local attack vector, high attack complexity (race condition timing), low privileges required, no user interaction, with full confidentiality/integrity/availability impact. Weakness is CWE-59 (Improper Link Resolution Before File Access, 'Link Following'), manifesting as a TOCTOU race between path validation and file access in the Cloud Session Recording component. No public exploit code is known to exist, and the CVE is not listed in CISA's KEV catalog; press mentions are part of a general roundup referencing the actor Midnight Blizzard rather than a confirmed exploitation report tied to this CVE. EPSS predicts a 0.1% likelihood of exploitation in the next 30 days (1st percentile, flat trend), indicating low observed exploitation interest at this time despite the high CVSS score.