EUVD-2026-63482
GHSA-wx22-7c2v-g5hw
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-accessible default web service, low-privilege auth confirmed by description and CVSS PR:L, full system impact via service account execution.
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
Lifecycle Timeline
2DescriptionCVE.org
NoMachine getstat Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is required to exploit this vulnerability.
The specific flaw exists within the web service, which listens on TCP port 4000 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. . Was ZDI-CAN-30634.
AnalysisAI
Remote code execution via OS command injection in NoMachine's web service allows authenticated remote attackers to execute arbitrary commands as the service account. The flaw, tracked by Zero Day Initiative as ZDI-CAN-30634 (ZDI-26-483), exists within the getstat command handler of the web service listening on TCP port 4000 by default, where user-supplied input is passed unsanitized to a system call. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires possession of any valid NoMachine account (low-privilege authentication - PR:L per CVSS vector; unauthenticated access is not sufficient). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.0 base score of 8.8 reflects a network-reachable, low-complexity attack (AV:N/AC:L) requiring only low-privilege authentication (PR:L), with no user interaction needed and full confidentiality, integrity, and availability impact (C:H/I:H/A:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch per the NoMachine knowledge base article TR06X11869 at https://kb.nomachine.com/TR06X11869; no exact fixed version number was confirmed in the available intelligence, so administrators should apply the latest available release and verify against vendor guidance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all NoMachine instances in the organization, particularly those with TCP port 4000 accessible from untrusted networks, and immediately implement firewall rules restricting web service access to authorized administrator IP ranges only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An unspecified server utility in NoMachine before 5.3.10 on Mac OS X and Linux allows authenticated users to gain privil
An arbitrary file overwrite vulnerability in NoMachine Free Edition and Enterprise Client for macOS before v8.8.1 allows
NoMachine before 5.3.27 and 6.x before 6.3.6 allows attackers to gain privileges via a Trojan horse wintab32.dll file lo
An uninitialised stack variable in the nxfuse component that is part of the Open Source DokanFS library shipped with NoM
Incorrect permissions for the folder C:\ProgramData\NoMachine\var\uninstall of Nomachine v7.9.2 allows attackers to perf
A vulnerability in NoMachine App for Android 5.0.63 and earlier allows attackers to alter environment variables via unsp
Local privilege escalation in NoMachine allows authenticated low-privileged attackers to execute arbitrary code as root
Local privilege escalation in NoMachine Device Server allows authenticated low-privileged attackers to execute arbitrary
NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. Rated high severity (CVSS 7.8), thi
Argument injection in NoMachine remote desktop software before versions 9.5.7 and 8.23.2 allows a local authenticated us
Arbitrary file deletion in NoMachine through environment variable path manipulation allows authenticated local attackers
The nxfs.sys driver in the DokanFS library 0.6.0 in NoMachine before 6.4.6 on Windows 10 allows local users to cause a d
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today