Which versions of NoMachine are affected by CVE-2026-53694?

NoMachine remote desktop software versions before 9.5.7 and 8.23.2 contain a high-severity argument injection vulnerability (CVSS 7.3) that allows authenticated local users to gain complete control…. A patch is available.

How to fix or mitigate CVE-2026-53694?

24 hours: Inventory all NoMachine deployments and identify systems running versions prior to 9.5.7 or 8.23.2; document business criticality. 7 days: Implement strict local access controls limiting NoMachine usage to essential personnel only; enable enhanced logging on NoMachine processes; isolate affected systems from network segments containing sensitive data. 30 days: Monitor NoMachine vendor advisories for patch availability (versions 9.5.7, 8.23.2, or later); establish upgrade testing and deployment plan for immediate execution upon patch release.

NoMachine CVE-2026-53694

Q: What is the CVSS score of CVE-2026-53694?

CVE-2026-53694 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-36060 HIGH

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)

2026-06-10 CIRCL

GHSA-pph3-cx78-q9jc

Code Injection Nomachine

7.3

CVSS 4.0 · Vendor: CIRCL

Severity by source

Vendor (CIRCL) PRIMARY

7.3 HIGH

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (CIRCL) · only source for this CVE.

CVSS VectorVendor: CIRCL

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 10, 2026 - 17:01 EUVD

Analysis Generated

Jun 10, 2026 - 16:29 vuln.today

CVSS changed

Jun 10, 2026 - 16:22 NVD

7.3 (HIGH)

DescriptionCVE.org

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Nomachine allows Argument Injection.This issue affects Nomachine: before 9.5.7, before 8.23.2.

AnalysisAI

Argument injection in NoMachine remote desktop software before versions 9.5.7 and 8.23.2 allows a local authenticated user to inject command-line arguments and achieve high-impact compromise of confidentiality, integrity, and availability on the host. The flaw is tracked as CWE-88 (Improper Neutralization of Argument Delimiters), reported by CIRCL, and at the time of analysis there is no public exploit identified.

Technical ContextAI

NoMachine is a commercial remote desktop and NX-protocol-based remote access suite that ships privileged helper components on Windows, Linux, and macOS hosts to broker sessions, manage displays, and execute system operations on behalf of users. CWE-88 (Argument Injection) covers cases where a process builds a child command line by concatenating user-controlled input without separating it from the executable's option parser, so values that contain leading hyphens or special delimiters are interpreted as additional flags rather than data. Per the affected CPE cpe:2.3:a:nomachine:nomachine, the weakness sits in NoMachine itself rather than a bundled third-party library, indicating one of NoMachine's own privileged wrappers fails to neutralize argument delimiters before invoking an underlying binary.

RemediationAI

Upgrade NoMachine to 9.5.7 or later on the 9.x branch, or to 8.23.2 or later on the 8.x branch, per the vendor advisories at https://kb.nomachine.com/SU05X00274 and https://kb.nomachine.com/SU05X00275; these are the only confirmed fixes. Until patching is complete, restrict interactive and remote-shell logon on NoMachine hosts to trusted administrators (the vulnerability requires local low-privileged access), remove non-essential local accounts, and audit setuid/privileged NoMachine helpers and scheduled tasks for invocation by unprivileged users, accepting that these controls reduce who can reach the vulnerable code path but do not eliminate the bug. Monitor process creation events for NoMachine binaries spawning child processes with unexpected argument flags as a detection compensating control, recognizing this will not prevent exploitation.