High-Severity Flaws in TeamViewer DEX Allow Attackers to Hijack Nomad Services

TeamViewer has issued security bulletins for its Digital Employee Experience (DEX) product line addressing multiple flaws across the Windows Client and the central Platform that could bypass integrity checks, execute arbitrary code, and escalate privileges.

The most critical vulnerability, CVE-2025-44016, affects the Content Distribution Service and versions prior to 25.11 on Windows, allowing a malicious actor on the local network to trick the service into trusting a malicious file and achieve arbitrary code execution under the Nomad Branch service.

In addition, TeamViewer patched CVE-2025-12687 (DoS) and CVE-2025-46266 (data leak), and a separate set of vulnerabilities in the DEX Platform, tracked as CVE-2025-64986 through CVE-2025-64989, could enable authenticated attackers with Actioner privileges to inject commands and break out of the intended script logic, with CVSS scores up to 7.2.

Privilege escalation flaws CVE-2025-64994 and CVE-2025-64995 were also identified in 1E-Nomad-SetWorkRate, exploitable by local attackers with write access to hijack processes and run code as SYSTEM. According to TeamViewer, fixes have been released, and administrators are advised to update to 25.11 or later for the Client and to ensure platform updates reach SaaS and On-Premise customers. However, there is no indication that these vulnerabilities have been exploited in the wild, so rapid remediation remains advisable.