CVE-2026-23571
Medium
Description
A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-RunPkgStatusRequest instruction. Improper input validation allows authenticated attackers with actioner privilege to run elevated arbitrary commands on connected hosts via malicious commands injected into the instruction’s input field. Users of 1E Client version 24.5 or higher are not affected.
SeverityMedium
CVSS6.8
Exploit probability—
Product
Teamviewer Digital Employee Experience
PublishedJan 29, 2026
First seenJan 29, 2026
Weakness typeCWE-20Improper input validation
How to fix
Update
- teamviewer digital_employee_experience26.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| teamviewer digital_employee_experience | v < 26.1 | 26.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.