CVE-2019-18988
HighExploitedPublic exploitTeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for different customers' installations.
Published Nov 5, 2021 · Updated Oct 21, 2025
Key Facts
Patch immediately- CVE-2019-18988 is a high-severity vulnerability (CVSS 7.0 v3.1) affecting Teamviewer.
- It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Nov 3, 2021. Public exploit code is available.
- EPSS estimates a 4.7% probability of exploitation in the next 30 days.
- Fixed versions are available, including Teamviewer <=14.7.1965, Teamviewer 14.7.1965.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v3.1
7.0
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
4.7%
Higher than 91.7% of all scored CVEs
Exploited in the wild
Yes
4 catalog listings
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2019-18988 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for different customers' installations. It used a shared AES key for all installations since at least as far back as v7.0.43148, and used it for at least OptionsPasswordAES in the current version of the product. If an attacker were to know this key, they could decrypt protect information stored in the registry or configuration files of TeamViewer. With versions before v9.x , this allowed for attackers to decrypt the Unattended Access password to the system (which allows for remote login to the system as well as headless file browsing). The latest version still uses the same key for OptionPasswordAES but appears to have changed how the Unattended Access password is stored. While in most cases an attacker requires an existing session on a system, if the registry/configuration keys were stored off of the machine (such as in a file share or online), an attacker could then decrypt the required password to login to the system.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| CISA KEV | Nov 3, 2021 | May 3, 2022 | Not reported |
| Industry KEV feed | Nov 3, 2021 | May 3, 2022 | Not reported |
| CIRCL KEV | Nov 3, 2021 | May 3, 2022 | Not reported |
| ENISA EUVD | Nov 3, 2021 | n/a | Not reported |
Required action: Apply updates per vendor instructions.
Affected Products
1 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| TeamviewerTeamviewer | See advisory | 14.7.1965 |
Patched Releases
Teamviewer
<=14.7.1965
Timeline
Added to CISA KEV
Nov 3, 2021
Added to Industry KEV feed
Nov 3, 2021
Added to CIRCL KEV
Nov 3, 2021
Added to ENISA EUVD
Nov 3, 2021
Publicly disclosed
Nov 5, 2021
Last updated
Oct 21, 2025
Weakness Type
- CWE-521 Weak Password Requirements
References
- advisoryhttps://community.teamviewer.com/t5/Announcements/Specification-on-CVE-2019-18988/td-p/82264
- advisoryhttps://community.teamviewer.com/t5/Knowledge-Base/tkb-p/Knowledgebase?threadtype=label&labels=Security
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2018-16550
- advisoryhttps://twitter.com/Blurbdust/status/1224212682594770946?s=20
- advisoryhttps://us-cert.cisa.gov/ics/advisories/icsa-21-308-01
FAQ
Common Questions.
TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for different customers' installations.
Affected: Teamviewer. The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Nov 3, 2021.
Yes. It was added on Nov 3, 2021 with a federal remediation due date of May 3, 2022.
Public exploit code is available.
Fixed versions are available, including Teamviewer <=14.7.1965, Teamviewer 14.7.1965.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2019-18988 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo