Back to Blog

Your IT Provider Uses TeamViewer to Fix Your Computer. New Flaws Let Attackers Turn That Around.

If you’ve ever called your IT person and they said “I’m going to remote in and take a look,” there’s a decent chance they were using TeamViewer. It’s one of the most common remote access tools around, used by IT departments, managed service providers, and independent technicians to fix computers without driving across town. Most small business owners have seen that little cursor moving on its own while their IT provider works. That’s TeamViewer doing its job.

In early October, TeamViewer disclosed five vulnerabilities in its software and urged users to patch immediately.[1] A few of them are standard remote access bugs. One of them is a little different.

The one worth paying attention to

Most remote access flaws work in the obvious direction: an attacker gets into a session and does something bad to the computer being controlled. CVE-2026-111585 goes the other way. It’s an integer overflow flaw in TeamViewer’s screen-processing component, and it lets a malicious host crash or potentially run code on the viewer, which is the machine of the person connecting to give support.[2]

What that means in plain terms: if your IT technician connects to a server or computer that has already been compromised, the attacker on the other end could use this flaw to attack the technician’s machine. Not yours. Theirs. And since IT providers often have admin access to dozens or hundreds of client systems, that’s a meaningful target.

There’s a second flaw, CVE-2026-92370, rated CVSS 8.8, that lets an authenticated remote participant bypass the user-configured permission settings during session establishment.[3] That one is more straightforward: it means access controls you think are protecting you may not be. Both are fixed in TeamViewer Client versions 15.82 and 15.83 respectively.

TeamViewer also patched a path-traversal vulnerability in its file transfer component (CVE-2026-16444), fixed in 15.81.5, which could be used to plant files outside of intended directories during a remote session. Combine that with a few other conditions and it can lead to code execution.[4]

Who’s actually exposed here

TeamViewer says it’s not aware of any active exploitation in the wild as of the disclosure date.[1] That’s worth something, but it’s also a snapshot in time. These flaws are now public, proof-of-concept code tends to follow, and attackers read security bulletins too.

Small businesses are increasingly the target. Kaspersky’s threat intelligence team found that over half of all initial access listings on dark web broker forums in the first four months of 2026 involved compromised small and medium-sized organizations.[5] Remote access tools are a known entry point. When credentials leak or software is unpatched, tools like TeamViewer become the door.

The version of TeamViewer on your machine matters here. If your IT provider manages your computers, they should be handling updates. If you manage your own, you need to check. The patched versions are 15.81.5, 15.82, and 15.83. Open TeamViewer, go to Help > About TeamViewer, and see what version you’re running. If it’s below those numbers, update it.

The bigger question to ask your IT provider

This is also a reasonable moment to ask whoever handles your IT: what remote access tools do they use, and how do they keep them updated? Not as an accusation. As a check. Good providers have a process for patching their own tools. They know what version of TeamViewer (or AnyDesk, or ConnectWise, or whatever they use) is deployed on your endpoints, and they push updates without waiting for you to ask.

If the answer is “we’ll get to it” or a blank stare, that’s useful information about how proactive your coverage actually is.

Remote access tools are trust infrastructure. They sit at the intersection of your systems and your IT provider’s systems, with elevated permissions on both sides. That makes keeping them patched about as non-negotiable as it gets.