TeamViewer Patches High-Severity Flaws Allowing Remote Command Execution and Unauthorized File Writes
TeamViewer has released patches for two high-severity vulnerabilities in its remote access products that could allow attackers to execute arbitrary commands and write files outside intended directories.
The most critical flaw, identified as CVE-2026-19042 and assigned a CVSS score of 8.8, affects TeamViewer Remote, Tensor, and ONE Full Client and Host components on Linux prior to version 15.81.5. Successful exploitation grants command execution with the privileges of the currently logged-in user. To deliver the malicious message, an attacker must already appear in the victim's contact list or obtain explicit permission to send messages from external users.
The second vulnerability, CVE-2026-16444 with a CVSS score of 7.5, results from insufficient validation of file paths. It impacts TeamViewer clients for Windows, macOS, and Linux before version 15.81.5. During an active remote session, files transferred or content sent via the virtual clipboard may contain path traversal sequences, enabling writes outside the expected directory and potential code execution under the affected user's permissions.
Older product lines, including editions supporting Windows 7 and Windows 8 as well as legacy TeamViewer 13 and TeamViewer 14 releases, also received specific security updates. The vendor strongly recommends upgrading to the most recent available version to mitigate the risks.
No evidence of active exploitation of either vulnerability had been observed at the time the security bulletins were published.
Related articles
pgAdmin 4 Database Management Tool Patches Multiple Vulnerabilities in Version 9.18
The development team behind pgAdmin 4, the popular management tool for PostgreSQL databases, has released version 9.18 to address multiple security issues. The update, published on September 17, 2026, includes fixes for four CVEs along with 29 total changes covering new features and bug resolutions. One vulnerability, tracked as CVE-2026-86863, stems from insufficient web server authentication that trusts external HTTP headers, enabling attackers to bypass login and impersonate administrators without passwords. A second issue, CVE-2026-86864, allows command injection through the backup feature when database names are passed as arguments, potentially leading to unauthorized file writes or exfiltration of connection passwords. The update is available now from the official pgAdmin repository.
Cisco Issues Emergency Patches for Critical ISE Zero-Day CVE-2026-76460 Already Exploited in Attacks
Cisco has released emergency patches for Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) to address CVE-2026-76460, a maximum-severity zero-day with a CVSS score of 10.0. The vulnerability stems from insufficient authentication controls in an API endpoint, allowing remote attackers to bypass authentication entirely without credentials. Active exploitation has been confirmed, enabling unauthorized access to the API gateway and potential root-level command execution when chained with further actions. The flaw affects all configurations of ISE and ISE-PIC, with no available workarounds, forcing organizations to apply updates immediately. Patches are available for branches 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4, while version 3.0 has reached end of software maintenance. Administrators are advised to review ise-kong access.log and node access logs for suspicious usernames and cross-reference with perimeter and firewall logs. In cases of confirmed compromise, affected nodes should be reinstalled and restored from backups, with iACLs recommended to restrict management traffic during rollout.
Stored XSS in Telegram Desktop Allows Silent Data Exfiltration via Chat Export
Researchers at ExPatch Vulnerability Research discovered a stored XSS vulnerability in Telegram Desktop that could be triggered when users exported chat history to HTML. The flaw resided in export_output_html.cpp where button text from inline keyboards was not passed through the SerializeString function, allowing arbitrary HTML and JavaScript to execute upon opening the exported file. Attackers could deliver the payload through a bot that never joined the target group, relying on message forwarding to reach victims. Once executed, the script exfiltrated all visible messages, chat metadata, and file paths to an attacker-controlled server while optionally replacing the page with a phishing form. Telegram issued a silent fix in Beta v6.9.4 and Stable v7.0.1 without publishing an advisory or assigning a CVE. The researchers refused the offered bounty and published the details after the patch to inform users about risks from previously exported files.
Cisco Confirms Active Exploitation of Critical Secure Email Gateway Flaw Allowing Root Command Execution
Cisco has confirmed active exploitation of a critical vulnerability in its Secure Email Gateway product that allows attackers to execute arbitrary commands with root privileges. The flaw, tracked as CVE-2026-76461 with a CVSS score of 9.8, stems from insufficient input validation in the message analysis logic of AsyncOS. Attackers can trigger the issue by sending a specially crafted email containing malicious SQL instructions, which leads to arbitrary SQL command execution and full root access on affected appliances. The vulnerability impacts physical and virtual deployments running AsyncOS versions 15.5 and earlier, 16.0, and 16.5. Patches are available in versions 15.5.5-0141, 16.0.4-302, and 16.5.0-780, while the Secure Email and Web Manager and Secure Web Appliance remain unaffected. CISA added the CVE to its Known Exploited Vulnerabilities catalog on September 14 and set a September 17 remediation deadline for federal agencies.