Multiple TeamViewer Vulnerabilities Enable Remote Code Execution Attacks
Brief
TeamViewer patched high-severity CVE-2026-16444, allowing authenticated remote-session attackers to write files to unintended locations and potentially execute code with user privileges .
The issue is detailed in TeamViewer security bulletin TV-2026-1008, published on August 26, 2026. It affects TeamViewer Remote, TeamViewer Tensor, and TeamViewer ONE deployments using vulnerable desktop client components.
CVE-2026-16444 stems from improper validation of file paths in TeamViewer Desktop Clients. The application fails to adequately sanitize filenames supplied by a remote peer before creating files on the receiving endpoint.
An authenticated participant in a TeamViewer remote session could exploit path-traversal sequences in filenames sent via the file-transfer function or the virtual file clipboard.