What is the CVSS score of CVE-2026-5055?

CVE-2026-5055 has a CVSS 3.0 base score of 7.8 (High). CVSS vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Nomachine are affected by CVE-2026-5055?

CVE-2026-5055 affects NoMachine Device Server and allows authenticated local users to escalate privileges to SYSTEM level through unsafe library loading, enabling complete system compromise.

How to fix or mitigate CVE-2026-5055?

Within 24 hours: Inventory all systems running NoMachine Device Server and document version numbers; confirm with NoMachine whether your installed version is affected. Within 7 days: Implement strict local access controls-restrict physical and remote desktop access to NoMachine Device Server systems to trusted administrators only; enable Enhanced Session Security features if available. Within 30 days: Contact NoMachine for patch availability timeline; evaluate migration to alternative remote access solutions if patch release is indefinite; apply the vendor-released patch immediately upon availability.

Nomachine CVE-2026-5055

EUVD-2026-21654 HIGH

Uncontrolled Search Path Element (CWE-427)

2026-04-11 zdi

GHSA-cfcr-ph9h-pgwq

RCE Privilege Escalation Nomachine

7.8

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Apr 11, 2026 - 01:00 euvd

EUVD-2026-21654

Analysis Generated

Apr 11, 2026 - 01:00 vuln.today

CVE Published

Apr 11, 2026 - 00:14 nvd

HIGH 7.8

DescriptionCVE.org

NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the NoMachine Device Server. The product loads a library from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-28494.

AnalysisAI

Local privilege escalation in NoMachine Device Server allows authenticated low-privileged attackers to execute arbitrary code with SYSTEM privileges by exploiting unsafe library loading from an unsecured search path. The vulnerability (ZDI-CAN-28494) requires prior local access but enables full system compromise through DLL hijacking or similar path manipulation. No KEV listing or public exploit identified at time of analysis. CVSS 7.8 (High) with attack vector requiring local access and low privileges (AV:L/PR:L).

Technical ContextAI

CWE-427 (Uncontrolled Search Path Element) vulnerability in NoMachine Device Server component. The service loads libraries from directories where unprivileged users can write files, creating a DLL hijacking condition. Exploitation requires planting a malicious library in the search path before service initialization or restart, achieving SYSTEM-level code execution through trusted service context.

RemediationAI

No vendor-released patch identified at time of analysis. Consult Zero Day Initiative advisory ZDI-26-249 at https://www.zerodayinitiative.com/advisories/ZDI-26-249/ for vendor coordination timeline and patch availability status. Interim workarounds: restrict local user access to NoMachine installation directories using NTFS permissions, disable NoMachine Device Server component if not operationally required, implement application whitelisting to prevent unauthorized DLL loading, and monitor system directories for unexpected library file creation. Deploy endpoint detection solutions configured to alert on privilege escalation attempts targeting service contexts.