SecBoard
Zurück zur CVE-Übersicht

CVE-2026-19743

HIGH(7.8)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Risk Signal Score20/100 — NIEDRIG
  • CVSS 7.8 — Hoch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.1%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

7.8

Technische Schwere

Beschreibung

Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges (NT AUTHORITY/SYSTEM \ root). By sending crafted IPC commands to the local service daemon, an attacker could manipulate file paths, leading to local privilege escalation.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • 15.82

Threat-Hunting-Queries

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName in~ ("TeamViewer.exe", "TeamViewer_Service.exe")
| where ProcessCommandLine contains "IPC" and ProcessCommandLine contains "write"
| where InitiatingProcessIntegrityLevel == "Low"
| project Timestamp, DeviceName, InitiatingProcessCommandLine, ProcessCommandLine, FileName, InitiatingProcessIntegrityLevel

Splunk SPL

index=your_windows_index (sourcetype=WinEventLog:Security OR sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational)
| (Image="*\\TeamViewer.exe" OR Image="*\\TeamViewer_Service.exe")
| CommandLine=*IPC* AND CommandLine=*write*
| IntegrityLevel="Low"
| table _time, host, Image, CommandLine, IntegrityLevel

Sigma

title: TeamViewer Local Privilege Escalation Attempt
status: experimental
description: Detects attempts to exploit CVE-2026-19743 in TeamViewer by monitoring for IPC commands involving file writes from low-privileged processes.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\TeamViewer.exe'
      - '\TeamViewer_Service.exe'
    CommandLine|contains:
      - 'IPC'
      - 'write'
    IntegrityLevel: 'Low'
  condition: selection
fields:
  - CommandLine
  - Image
  - IntegrityLevel
tags:
  - attack.privilege_escalation
  - cve.2026.19743

Elastic ES|QL

from process where process.executable.name in ("TeamViewer.exe", "TeamViewer_Service.exe") and process.command_line : ("*IPC*", "*write*") and process.integrity_level == "low"

SecBoard-generated behavioral requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen