Raw vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:HSummary
CVE-2026-12703 is a high-severity Authentication Bypass Using an Alternate Path or Channel (CWE-288) vulnerability in Teamviewer (inferred from references). Its CVSS base score is 8.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique External Remote Services (T1133); ranked at the 15th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and IA-2 (Identification and Authentication (Organizational Users)) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-50360
Vulnerability Data
TeamViewer Full Client and Host for macOS before version 15.80 contain a business logic error that can allow an authenticated attacker to bypass a configured 2FA for Connections approval flow via Unattended Access and establish a remote connection to an…
more
affected macOS host.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Business logic flaw enables 2FA bypass for TeamViewer Unattended Access, directly facilitating unauthorized external remote services and remote access tool usage.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces the configured 2FA connection-approval policy and blocks the alternate Unattended Access path that bypasses it.
Mandates identification and authentication (including MFA) for all organizational users before allowing remote sessions, eliminating the CWE-288 bypass.
Requires explicit connection requirements, authorization, and monitoring for remote access, preventing unauthorized bypass of approval flows.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Requiring authentication on every channel and path directly eliminates alternate-path bypasses.
Enforcing authorizations and least privilege across all access vectors prevents unauthenticated alternate paths.
Protecting networks and environments from unauthorized logical access blocks bypass via undocumented channels.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect alternate-path bypasses but does not prevent them in production.
Secure authentication control directly mitigates bypass by requiring strong, consistent authentication on all paths.
Access control policy directly addresses alternate authentication paths by requiring all channels to enforce authentication.
Authentication information management ensures credentials and mechanisms are consistently applied across all access paths.
Access rights provisioning and review prevent bypass via unmonitored or alternate channels.
Privileged access rights control reduces risk of bypass through elevated or alternate paths.