# CVE-2026-92376: TeamViewer Remote Management Monitoring IPC broker impersonation privilege escalation

Source: https://junglewise.ai/threats/cve-2026-92376-improper-authentication-in-the-inter-process-communication-ipc  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-92376 · Severity: high · CVSS 7.8 · Published 2026-10-27

TeamViewer Remote Management Monitoring is a system management service that runs with system-level privileges on Windows computers. An attacker with a standard user account can impersonate the IPC (inter-process communication) broker to trick the Monitoring service into executing arbitrary code with full system privileges, achieving complete local system compromise.

Technologies: [Teamviewer Remote Management Monitoring](https://junglewise.ai/threats/technologies/remote-management-monitoring). Vendors: [Teamviewer](https://junglewise.ai/threats/vendors/teamviewer).

## Quick answers

**Is CVE-2026-92376 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92376 being exploited in the wild.

**How severe is CVE-2026-92376?** High severity, with a CVSS score of 7.8, published 27 October 2026.

**Which products and versions are affected?** Teamviewer Remote Management Monitoring prior to 26.10.1.

**Is there a fix for CVE-2026-92376?** Yes: fixed in 26.10.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92376 attacked?** It is attacked with local access, in a hosted service.

**Am I affected by CVE-2026-92376?** Check whether you run Teamviewer Remote Management Monitoring at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 26.10.1

## Technical details

Improper authentication in the IPC mechanism of TeamViewer Remote Management Monitoring (ITbrain_Monitoring_Service.exe) prior to v26.10.1 allows a local authenticated attacker with low privileges to impersonate the IPC broker and cause the service to execute arbitrary code as NT AUTHORITY\SYSTEM. The vulnerability requires local access and low-privilege authentication but no user interaction. A fix is available in version 26.10.1.

## Affected products

- TeamViewer Remote Management Monitoring prior to 26.10.1

## Timeline

- 2026-10-27: disclosed

## References

- [https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1012/](https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1012/)

## Related threats

- [TeamViewer improper IPC access control in Remote Management Monitoring](https://junglewise.ai/threats/cve-2026-92375-an-improper-access-control-vulnerability-in-the-ipc-communication)
- [TeamViewer Remote Management Monitoring DLL loading privilege escalation](https://junglewise.ai/threats/cve-2026-111582-a-dll-loading-vulnerability-in-the-teamviewer-remote-management)