What is the CVSS score of CVE-2026-5054?

CVE-2026-5054 has a CVSS 3.0 base score of 7.8 (High). CVSS vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Nomachine are affected by CVE-2026-5054?

CVE-2026-5054 is a local privilege escalation vulnerability in NoMachine that allows low-privileged users already present on a system to execute arbitrary code with root privileges through path…

How to fix or mitigate CVE-2026-5054?

Within 24 hours: Identify all systems running NoMachine and document current version numbers across your environment. Within 7 days: Implement access controls restricting NoMachine usage to trusted users only and monitor NoMachine process execution logs for suspicious activity. Within 30 days: Contact NoMachine vendor for patch availability status and timeline; if patch is released, prioritize deployment on systems with elevated risk exposure. In interim, restrict unprivileged user account creation on NoMachine hosts and review privilege escalation audit logs.

Nomachine CVE-2026-5054

EUVD-2026-21653 HIGH

External Control of File Name or Path (CWE-73)

2026-04-11 zdi

GHSA-4399-fg4g-454c

RCE Privilege Escalation Nomachine

7.8

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Apr 11, 2026 - 01:00 euvd

EUVD-2026-21653

Analysis Generated

Apr 11, 2026 - 01:00 vuln.today

CVE Published

Apr 11, 2026 - 00:14 nvd

HIGH 7.8

DescriptionCVE.org

NoMachine External Control of File Path Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the handling of command line parameters. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-28630.

AnalysisAI

Local privilege escalation in NoMachine allows authenticated low-privileged attackers to execute arbitrary code as root through improper validation of command line path parameters. The vulnerability stems from insufficient sanitization of user-supplied file paths in file operations, enabling path traversal to manipulate privileged system resources. Exploitation requires existing low-privileged code execution on the target system. CVSS 7.8 (High) reflects local attack vector with low complexity and no user interaction required. No public exploit identified at time of analysis.

Technical ContextAI

CWE-73 (External Control of File Name or Path) exploitation through command line parameter processing. Lack of canonical path validation enables attacker-controlled file path to redirect file operations, likely abusing symbolic links or directory traversal sequences to write/modify privileged files. Root context execution achieved through service/daemon interaction with unsanitized paths.

RemediationAI

Patch available per vendor advisory. Consult Zero Day Initiative advisory ZDI-26-248 at https://www.zerodayinitiative.com/advisories/ZDI-26-248/ for patched version details and deployment guidance. Until patch applied, restrict local user access to trusted accounts only, enforce least privilege principles, and monitor command line arguments passed to NoMachine service processes for suspicious path patterns. Implement application whitelisting to prevent unauthorized low-privileged code execution. Disable NoMachine service on non-essential systems. Review file operation audit logs for unexpected privileged file access patterns indicating exploitation attempts.