TeamViewer's 29 September bulletin fixes five High-severity flaws in Full Client and Host, including a remote-session permission bypass. The current corrected version is 15.82; older branches need the platform-specific legacy fixes. The vendor reports no known exploitation. Remote-support software depends on an unusually important promise: the person granting access should be able to decide what the other party can do. A session that connects successfully is not enough. The selected restrictions also have to hold. Five paths with different prerequisites VulnerabilityCondition and consequence CVE-2026-19743Local low-privilege IPC user: elevated file writes on Windows, macOS and Linux. CVE-2026-92368Linux/macOS 15.70 to below 15.82: crafted recording, code execution. Prose requires opening it; the vector says no user interaction. CVE-2026-92369Local low-privilege Windows user: a successfully timed installer-rollback race can grant SYSTEM. CVE-2026-92370Remote-session restrictions bypassed, potentially allowing code execution. Prose says authenticated attacker; the vector says no privileges but user interaction. CVE-2026-92371Authenticated local Linux user, 15.0 to below 15.82: recording-path race enables privileged file operations. Those contradictory prerequisites are unresolved. Do not reinterpret them as evidence of unattended, unauthenticated internet takeover. Consult the complete affected-product and fixed-build matrix before selecting a package. Find the installations outside the usual update list BlackTree's operational assessment: Treat this as an estate-wide remote-support review. Compare endpoint-management records with software inventories, service lists and supplier-maintained asset lists. A deployment dashboard can only report on the devices it knows. Jump boxes, technicians' systems and externally maintained machines deserve an explicit owner rather than an assumption that another team handles them. For each…