Splashtop and AnyDesk vulnerabilities and fixes

CVEs that mention Splashtop and AnyDesk, ranked by priority. 7 tracked.

Splashtop and AnyDesk has 7 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 0. Most recent: 2026-10-12. Highest priority: CVE-2026-109390 (score 64/100).

• CVE-2026-109390 CRITICAL 9.8 AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer
• CVE-2026-92370 HIGH 8.8 An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Wind
• CVE-2026-19743 HIGH 7.8 Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and ma
• CVE-2026-92368 HIGH 7.8 TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow v
• CVE-2026-92371 HIGH 7.0 TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerabili
• CVE-2026-92369 HIGH 7.3 TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the insta
• CVE-2026-2695 MEDIUM 6.3 A command injection vulnerability was discovered in TeamViewer DEX Platform On-Premises (former 1E DEX Platfor

FAQ

How do I fix Splashtop and AnyDesk vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Splashtop and AnyDesk being exploited right now?

None of the tracked Splashtop and AnyDesk CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Splashtop and AnyDesk CVE should I patch first?

CVE-2026-109390 currently ranks highest (64/100): AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer.

RSS feed for Splashtop and AnyDesk · ← Back to latest CVEs