EUVD-2026-21651Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local code execution as low-privileged user
-
ExploitCraft malicious environment variable with path
-
ExecutionNoMachine processes variable without validation
-
ImpactArbitrary file deletion executed as root
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File name/path control
|
| Exploitation Conditions | Requires local low-privileged code execution on the NoMachine target system. Attacker exploits improper environment variable validation in file operations to delete arbitrary files with root privileges. No user interaction needed. |
| Impact | Local privilege escalation enabling root-level arbitrary file deletion. CVSS 7.1 reflects high integrity/availability impact but requires prior code execution foothold. EPSS data unavailable; ZDI disclosure suggests coordinated patching. Priority depends on NoMachine deployment scope and whether local execution boundaries are enforced in your environment. |
| Exploit ScenarioDerived | Attacker with local low-privileged access manipulates environment variables to redirect file operations, causing NoMachine process (running as root) to delete arbitrary files. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 11, 2026
Arbitrary file deletion in NoMachine through environment variable path manipulation allows authenticated local attackers to delete system files with root privileges. Vulnerability stems from insufficient validation of user-supplied paths in file operations, enabling low-privileged users to escalate impact by removing critical files. Affects NoMachine cross-platform remote desktop software. No public exploit identified at time of analysis.
RemediationAI
No vendor-released patch identified at time of analysis. Organizations should monitor NoMachine vendor advisory channels and apply updates immediately upon release. Interim mitigations: restrict local access to NoMachine installations through operating system permissions, enforce principle of least privilege for user accounts, implement file integrity monitoring for critical system paths, and audit environment variable usage in NoMachine configurations. Review ZDI advisory for vendor coordination status: https://www.zerodayinitiative.com/advisories/ZDI-26-247/. Disable NoMachine service on systems where remote desktop functionality is not operationally required until patched version becomes available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-73 external control of file path flaw in environment variable processing. Attacker-controlled path values bypass validation checks before file system operations execute under elevated root context, enabling unauthorized file deletion outside intended scope.
Know when Nomachine gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
NoMachine External Control of File Path Arbitrary File Deletion Vulnerability. This vulnerability allows local attackers to delete arbitrary files on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the handling of environment variables. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files in the context of root. Was ZDI-CAN-28644.
Executive ViewAI
CVE-2026-5053 affects NoMachine remote desktop software, allowing authenticated local users to delete arbitrary system files with root privileges through environment variable manipulation. This creates a privilege escalation risk for organizations using NoMachine for remote access, as compromised or malicious local accounts can disable critical system functionality or degrade operational security controls.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict local system access to NoMachine hosts through OS-level access controls and privileged account management; (2) Monitor and audit environment variable configuration on NoMachine systems; (3) Disable NoMachine on systems not requiring remote access; (4) Implement file integrity monitoring on critical system directories; (5) Isolate NoMachine infrastructure on separate network segments with restricted outbound connectivity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Related Vulnerabilities in NoMachine Local Privilege Escalation
View all 3An unspecified server utility in NoMachine before 5.3.10 on Mac OS X and Linux allows authenticated users to gain privil
An arbitrary file overwrite vulnerability in NoMachine Free Edition and Enterprise Client for macOS before v8.8.1 allows
NoMachine Enterprise Client is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low a
NoMachine Enterprise Client is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low at
NoMachine Cloud Server is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack
NoMachine Cloud Server is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack
NoMachine Enterprise Desktop is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low
NoMachine Enterprise Desktop is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low a
NoMachine Server is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack compl
NoMachine Server is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack comple
NoMachine before 5.3.27 and 6.x before 6.3.6 allows attackers to gain privileges via a Trojan horse wintab32.dll file lo
An uninitialised stack variable in the nxfuse component that is part of the Open Source DokanFS library shipped with NoM
GitHub PoC
Exploit-DB