CVE-2026-23566

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23566", "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6", "state": "PUBLISHED", "assignerShortName": "TV", "dateReserved": "2026-01-14T13:54:40.322Z", "datePublished": "2026-01-29T08:46:02.075Z", "dateUpdated": "2026-01-29T16:44:19.585Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["Content Distribution Service", "NomadBranch.exe"], "platforms": ["Windows"], "product": "DEX", "vendor": "TeamViewer", "versions": [{"lessThan": "26.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Threat Hunt Team of Bank of America"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an attacker on the adjacent network to inject, tamper with, or forge log entries in \\Nomad Branch.log via crafted data sent to the UDP network handler. This can impact log integrity and nonrepudiation."}], "value": "A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an attacker on the adjacent network to inject, tamper with, or forge log entries in \\Nomad Branch.log via crafted data sent to the UDP network handler. This can impact log integrity and nonrepudiation."}], "impacts": [{"capecId": "CAPEC-153", "descriptions": [{"lang": "en", "value": "CAPEC-153 Input Data Manipulation"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6", "shortName": "TV", "dateUpdated": "2026-01-29T08:46:02.075Z"}, "references": [{"url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1001/"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update the TeamViewer DEX Client (1E Client) to the latest available version."}], "value": "Update the TeamViewer DEX Client (1E Client) to the latest available version."}], "source": {"discovery": "UNKNOWN"}, "title": "Log Injection in Content Distribution Service UDP Handler", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-29T15:56:46.401061Z", "id": "CVE-2026-23566", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-29T16:44:19.585Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23566", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-29T15:56:46.401061Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-29T15:56:49.011Z"}}], "cna": {"title": "Log Injection in Content Distribution Service UDP Handler", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Threat Hunt Team of Bank of America"}], "impacts": [{"capecId": "CAPEC-153", "descriptions": [{"lang": "en", "value": "CAPEC-153 Input Data Manipulation"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "TeamViewer", "modules": ["Content Distribution Service", "NomadBranch.exe"], "product": "DEX", "versions": [{"status": "affected", "version": "0", "lessThan": "26.1", "versionType": "custom"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update the TeamViewer DEX Client (1E Client) to the latest available version.", "supportingMedia": [{"type": "text/html", "value": "Update the TeamViewer DEX Client (1E Client) to the latest available version.", "base64": false}]}], "references": [{"url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1001/"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an attacker on the adjacent network to inject, tamper with, or forge log entries in \\Nomad Branch.log via crafted data sent to the UDP network handler. This can impact log integrity and nonrepudiation.", "supportingMedia": [{"type": "text/html", "value": "A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an attacker on the adjacent network to inject, tamper with, or forge log entries in \\Nomad Branch.log via crafted data sent to the UDP network handler. This can impact log integrity and nonrepudiation.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6", "shortName": "TV", "dateUpdated": "2026-01-29T08:46:02.075Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23566", "state": "PUBLISHED", "dateUpdated": "2026-01-29T16:44:19.585Z", "dateReserved": "2026-01-14T13:54:40.322Z", "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6", "datePublished": "2026-01-29T08:46:02.075Z", "assignerShortName": "TV"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["Content Distribution Service", "NomadBranch.exe"], "platforms": ["Windows"], "product": "DEX", "vendor": "TeamViewer", "versions": [{"lessThan": "26.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "psirt@teamviewer.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:teamviewer:digital_employee_experience:*:*:*:*:*:*:*:*", "matchCriteriaId": "8E2A5CE4-D147-45E1-8D16-3257B6E79E70", "versionEndExcluding": "26.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an attacker on the adjacent network to inject, tamper with, or forge log entries in \\Nomad Branch.log via crafted data sent to the UDP network handler. This can impact log integrity and nonrepudiation."}, {"lang": "es", "value": "Una vulnerabilidad en TeamViewer DEX Client (anteriormente 1E Client) - Servicio de Distribuci\u00f3n de Contenido (NomadBranch.exe) anterior a la versi\u00f3n 26.1 para Windows permite a un atacante en la red adyacente inyectar, manipular o falsificar entradas de registro en \\Nomad Branch.log a trav\u00e9s de datos manipulados enviados al manejador de red UDP. Esto puede impactar la integridad del registro y la no repudiaci\u00f3n."}], "id": "CVE-2026-23566", "lastModified": "2026-06-17T10:21:47.227", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "psirt@teamviewer.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23566", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-29T15:56:46.401061Z", "version": "2.0.3"}}]}, "published": "2026-01-29T09:16:04.217", "references": [{"source": "psirt@teamviewer.com", "tags": ["Vendor Advisory"], "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1001/"}], "sourceIdentifier": "psirt@teamviewer.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "psirt@teamviewer.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T01:30:52.629320+00:00", "value": {"mitigation_remediation": ["Update the TeamViewer DEX Client to the latest available version.", "If an immediate update is not possible, block or filter UDP traffic that targets the Content Distribution Service on the affected machines.", "Ensure that logs are stored in a tamper\u2011resistant manner, such as using dedicated log management solutions with signed entries, to preserve integrity."], "summary": {"action": "Patch", "impact": "Log Integrity"}, "threat_synthesis": {"affected_systems": "Affected systems include the TeamViewer Digital Employee Experience (DEX) Client, formerly known as 1E Client, on Windows platforms. Versions before 26.1 are vulnerable; users should verify they are on version 26.1 or newer. No other products are listed.", "description_and_impact": "The vulnerability enables an attacker on the same network to craft UDP packets that are processed by the Content Distribution Service (NomadBranch.exe) in the TeamViewer DEX Client. By injecting malicious data, the attacker can insert, modify, or forge entries in the Nomad Branch.log file, thereby compromising the integrity of log data and undermining nonrepudiation guarantees. This flaw is a classic input validation issue (CWE\u201120).", "risk_and_exploitability": "The CVSS base score of 6.5 indicates a moderate severity. The EPSS score of less than 1% suggests a very low probability of exploitation in the wild, and the flaw is not currently listed in the CISA Known Exploited Vulnerabilities catalog. The attack requires the adversary to be on the adjacent network and to send crafted UDP packets to the service's handler; it does not require advanced credentials or bypass of authentication, but it can lead to misleading audit trails if the logs are relied upon for incident response."}}}}, "created": "2026-01-30T08:43:25.795558+00:00", "updated": "2026-04-18T01:45:33.385579+00:00", "vendors": ["teamviewer", "teamviewer$PRODUCT$dex"]}