NoMachine CVE-2026-18264

Exploitation requires possession of any valid NoMachine account (low-privilege authentication - PR:L per CVSS vector; unauthenticated access is not sufficient). The target must be running NoMachine's web service with port 4000 accessible to the attacker over the network - this is the default configuration, not a non-default deployment mode. The vulnerable code path is specifically the getstat command handler within the web service component. Exploitation is limited by: (1) the need for at least one valid credential, and (2) network reachability to TCP port 4000. There is no indication that a specific non-default feature flag or configuration option must be enabled beyond the standard NoMachine web service being operational.

The CVSS 3.0 base score of 8.8 reflects a network-reachable, low-complexity attack (AV:N/AC:L) requiring only low-privilege authentication (PR:L), with no user interaction needed and full confidentiality, integrity, and availability impact (C:H/I:H/A:H). The primary limiting factor is the PR:L requirement - an attacker must possess any valid NoMachine account, which meaningfully constrains opportunistic mass exploitation but does not protect against insider threats or environments with weak credential hygiene. No EPSS data was provided in the source intelligence, limiting probabilistic exploitation forecasting. The vulnerability is not listed in CISA KEV, and no public exploit code has been identified, meaning the current threat posture is elevated-but-not-confirmed-exploited. ZDI disclosure (ZDI-26-483) typically follows vendor coordination and patch readiness, suggesting remediation is available or imminent via the NoMachine KB advisory. Any organization deploying NoMachine for enterprise remote access - particularly where port 4000 is exposed beyond a trusted perimeter - should treat this as a high-priority patch cycle item rather than a theoretical concern.

An attacker who obtains any valid NoMachine credential - through phishing, credential stuffing, or insider access - connects to the web service on TCP port 4000 and sends a crafted request to the getstat command handler embedding shell metacharacters in a user-controlled parameter. The service passes the unsanitized string directly to a system call, executing attacker-supplied commands in the context of the NoMachine service account. No public proof-of-concept has been identified, but CWE-78 exploitation is well understood and the pattern is reliably reproducible given the described lack of input validation.