# CVE-2026-111584: TeamViewer Remote Management Patch Management race condition in installation

Source: https://junglewise.ai/threats/cve-2026-111584-a-race-condition-in-the-installation-process-of-teamviewer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-111584 · Severity: high · CVSS 7.3 · Published 2026-10-27

TeamViewer's Remote Management Patch Management component for Windows contains a race condition in its installation process that allows a locally authenticated user with standard privileges to execute code with administrative rights. An attacker could exploit this by replacing service files in a temporary directory during activation, potentially gaining full control of the system and access to sensitive data.

Vendors: [Teamviewer](https://junglewise.ai/threats/vendors/teamviewer).

## Quick answers

**Is CVE-2026-111584 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111584 being exploited in the wild.

**How severe is CVE-2026-111584?** High severity, with a CVSS score of 7.3, published 27 October 2026.

**Which products and versions are affected?** Teamviewer Remote Management Patch Management prior to 26.9.1.

**Is there a fix for CVE-2026-111584?** Yes: fixed in TeamViewer Remote Management Patch Management 26.9.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111584 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-111584?** Check whether you run Teamviewer Remote Management Patch Management at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in TeamViewer Remote Management Patch Management 26.9.1

## Technical details

A race condition in the Patch Management activation process fails to properly protect a temporary directory containing the service executable, allowing a local authenticated attacker with low privileges to perform a time-of-check-time-of-use (TOCTOU) attack. By replacing the service executable in the insufficiently protected temporary directory, an attacker can achieve arbitrary code execution with SYSTEM privileges. The vulnerability requires local authentication and file system access during the Patch Management activation window.

## Affected products

- TeamViewer Remote Management Patch Management prior to 26.9.1

## Timeline

- 2026-10-27: disclosed

## References

- [https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1012/](https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1012/)