CVE-2019-18988
CISA KEVPublished November 3, 2021 · Updated April 3, 2026
high
Official Description+
TeamViewer Desktop allows for bypass of remote-login access control because the same AES key is used for different customers' installations. If an attacker were to know this key, they could decrypt protected information stored in registry or configuration files or decryption of the Unattended Access password to the system (which allows for remote login to the system).
Affected Products
| Vendor | Product |
|---|---|
| TeamViewer | Desktop |
Patch Status
Patch by 2022-05-03
Recommended Actions
- Check if your systems use any of the affected products listed above.
- Apply vendor patches immediately if available.
- This vulnerability is in CISA's Known Exploited Vulnerabilities catalog — prioritize remediation.
- Monitor vendor advisories for updates and additional mitigations.
- Review logs for indicators of compromise related to CVE-2019-18988.