1. Summary
PHP disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are in the upstream open-source PHP software and are not vulnerabilities assigned to TeamViewer products. These vulnerabilities may, under applicable conditions, allow an unauthenticated attacker to execute code on a vulnerable web server. PHP rates both vulnerabilities at CVSS 9.2 and released security updates on October 21, 2026.
TeamViewer assessed their applicability across its products, services, and supporting environments. Relevant environments were prioritized, and appropriate remediation, containment, or exposure-reduction measures were implemented. The product and service status resulting from this assessment are provided below. In this case we have identified that at this time no customer actions are required for the products that have had minimal impact.
2. Vulnerability details
Under applicable conditions, the vulnerabilities could allow an unauthenticated attacker to execute code on an affected web server. PHP has published security updates and technical guidance for affected installations.
More details under:
3. TeamViewer product and service status
Products not identified as affected
Products with minimal impact
4. TeamViewer response and current status
TeamViewer’s Security organization assessed both vulnerabilities and identified relevant environments requiring remediation or further validation. Affected or potentially affected environments, including externally accessible environments, were prioritized.
TeamViewer’s approach is: Assess → Contain → Patch → Verify. Where updates could be deployed, TeamViewer updated the relevant environments. Where updates could not immediately be applied, containment or exposure-reduction measures were implemented.
TeamViewer assessed the vulnerabilities across relevant products, services, and supporting environments. Applicable security updates were deployed where required. Where immediate patching was not possible, TeamViewer implemented containment or exposure-reduction measures, including temporary restrictions where appropriate. Customer-relevant remediation and validation activities have been completed.
This advisory addresses CVE-2026-109618 and CVE-2026-109619. Other PHP security disclosures are assessed separately through TeamViewer’s established vulnerability-management processes.
5. Customer guidance
No specific customer action is required in relation to these vulnerabilities for the products and services identified above. Customers should continue to follow normal security practices and keep TeamViewer software up to date.
TeamViewer assesses security-relevant information through established security processes and does not provide unverified conclusions about security investigations. The presence of a software vulnerability does not by itself establish unauthorized access or an impact on customer data. TeamViewer continues to monitor relevant security information and will communicate directly with customers if any customer-specific action becomes necessary.
6. Updates
TeamViewer continues to monitor vendor guidance and threat intelligence. Customer-relevant service availability or service-impact information will be published through TeamViewer’s established communication channels, and this bulletin will be updated if the assessment or remediation status materially changes. Customer-relevant service availability and service-impact information is published on the TeamViewer Status Page.
Last updated: October 30, 2026.