NoMachine CVE-2026-114549
CRITICALAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach web service on TCP 4443
-
ExploitSend over-length user-supplied data
-
ExecutionOverflow heap buffer in nxwebrunner
-
ImpactExecute code as service account
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the NoMachine web service (nxwebrunner), which listens on TCP port 4443 by default - meaning default installations exposing this port are attackable. No authentication, local access, or user interaction is required (PR:N/UI:N), so any attacker who can reach port 4443 can attempt exploitation. Limiting factors: the attacker must be able to route to port 4443 (hosts where this port is firewalled, bound to localhost, or the web service is disabled are not remotely exposed), and the achieved privileges are those of the service account running the web service rather than guaranteed root/SYSTEM. No non-default feature toggle is stated as a prerequisite beyond the web service being active. |
| Impact | Multiple signals align toward genuine high priority rather than an inflated-CVSS artifact. The CVSS 3.0 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with full confidentiality, integrity, and availability impact, which the description corroborates: remote code execution via the web service on TCP 4443 with no authentication. The vuln.today Decision label is 'act_now', reinforcing urgency. However, key exploitation-likelihood signals are absent: no EPSS probability was provided, the vulnerability is not listed in CISA KEV (no confirmed active exploitation), and no working public exploit code is indicated - the only reference is the ZDI advisory (ZDI-26-786, originally ZDI-CAN-30685). So this is a coordinated-disclosure finding from Trend Micro ZDI with strong intrinsic severity but no evidence yet of in-the-wild use or available weaponized code. The practical risk is driven by the low barrier to exploitation (network, unauthenticated) and the sensitive outcome (code execution as the service account), tempered by the fact that exploitation currently requires an attacker to develop the heap-overflow exploit themselves. EPSS being unavailable means widespread-exploitation probability cannot be quantified from the provided data. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker reaches a NoMachine host's web service on TCP port 4443 and sends a request containing an over-length user-supplied field that is copied into a heap buffer without a length check, overflowing it and leading to arbitrary code execution in the service account's context. Given AV:N/AC:L/PR:N/UI:N, no credentials, local access, or user interaction are needed. No verified working exploit code is identified in the provided data; only the ZDI advisory is referenced. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 04, 2026
NoMachine's nxwebrunner web service, which listens on TCP port 4443 by default, fails to validate the length of user-supplied data before copying it into a fixed-size heap buffer, allowing an unauthenticated attacker with network reachability to that port to execute arbitrary code as the web service account. The flaw is rated critical (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N) and carries an act_now priority label from vuln.today; no CISA KEV entry, EPSS value, or confirmed public exploit code was supplied with this report, so active exploitation is not established. Hosts where port 4443 is firewalled, bound to localhost, or where the web service is disabled are not remotely exposed.
RemediationAI
No vendor patch version is specified in the available data, so the first action is to consult the ZDI advisory ZDI-26-786 (https://www.zerodayinitiative.com/advisories/ZDI-26-786/) and NoMachine's own release notes for the fixed build and upgrade nxwebrunner to it. In the interim, reduce exposure by restricting TCP 4443 to trusted source networks with firewall or security-group rules, or by binding nxwebrunner to localhost or disabling the web service entirely where it is not needed; each of these also removes legitimate browser-based NoMachine access for the blocked clients. Because the flaw is reachable pre-authentication, network filtering is the most direct compensating control until the fixed version is deployed, and the service should run under a least-privileged account to bound the impact of any successful exploitation.
Affected ProductsAI
NoMachine installations that include and expose the nxwebrunner web service, which listens on TCP port 4443 by default, are affected. No CPE strings or explicit version ranges were included in the supplied intelligence; the only vendor-side reference is the ZDI advisory ZDI-26-786 (https://www.zerodayinitiative.com/advisories/ZDI-26-786/), which operators should consult for the definitive list of affected NoMachine versions. Deployments where nxwebrunner is not enabled, is bound only to localhost, or is blocked by firewall rules are not remotely exposed to this issue.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is nxwebrunner, the NoMachine web service that accepts remote connections over TCP 4443 by default. The root cause is CWE-122, a heap-based buffer overflow: the service does not adequately validate the length of attacker-supplied input before copying it into a heap-allocated buffer, so oversized data can overrun the allocation and corrupt adjacent heap metadata or adjacent objects. Because the process runs as the web service's own account, successful exploitation yields code execution at that privilege level rather than guaranteed root or SYSTEM. The disclosure originates from Trend Micro's Zero Day Initiative (ZDI-CAN-30685, advisory ZDI-26-786), and the CVSS 3.0 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) matches the independently assessed CVSS 3.1 vector, indicating no authentication, no user interaction, and full confidentiality, integrity and availability impact. The specific request path and payload structure that trigger the overflow are not described in the available sources.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network RCE on a default-listening web service (AV:N/AC:L/PR:N/UI:N) yielding code execution, so full C/I/A impact; scope unchanged as code runs in the service's own context.
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
DescriptionCVE.org
NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the web service, which listens on TCP port 4443 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-30685.
Executive ViewAI
CVE-2026-114549 is a critical unauthenticated remote code execution vulnerability in NoMachine's nxwebrunner web service (listening on TCP port 4443 by default). Any internet- or network-facing NoMachine deployment is at risk of full compromise of the web service account by an unauthenticated attacker, potentially leading to data breach, lateral movement, and service disruption. Leadership should prioritize immediate containment because no patch is available and exposure is binary: if port 4443 is reachable, the organization is exposed.
No vendor-released patch identified at time of analysis; interim mitigations include blocking inbound TCP port 4443 at network boundaries, disabling the nxwebrunner web service if not needed, restricting access to trusted networks via firewall rules, and monitoring for exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
GitHub PoC
Exploit-DB