EUVD-2026-107398
GHSA-g7q4-gvgr-3xv5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local shell
-
DeliveryPredict weak Redis credentials (CWE-331)
-
ExploitAuthenticate to local Redis
-
ExecutionExecute code as service account
-
ImpactEscalate privileges on host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Entropy requirements
|
| Exploitation Conditions | Exploitation requires the attacker to first have the ability to execute low-privileged code on the target host (local access per AV:L, with PR:L), and the target must be running NoMachine with its bundled Redis database whose access-control credentials are generated with insufficient entropy (CWE-331). The core enabling condition is the predictable/guessable Redis credential; the limiting factors are that no remote network vector exists and an initial unprivileged foothold on the machine is mandatory, confining this to multi-user or already-compromised hosts. No user interaction is required (UI:N). |
| Impact | This is a genuine but bounded risk. The CVSS 3.0 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local privilege-escalation requiring the attacker to already hold low-privileged code execution on the host - it is not remotely reachable on its own. The ZDI advisory (ZDI-CAN-30984 / ZDI-26-711) confirms the vendor-independent researcher finding, and CWE-331 (Insufficient Entropy) aligns with the description of predictable/guessable Redis credentials. Signals are partly missing: no EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no public exploit identified at time of analysis. The low complexity (AC:L) and full C/I/A impact make it a worthwhile patch priority on multi-user or shared NoMachine hosts, but as a local-only chain it is a second-stage escalation rather than an internet-facing emergency. Note the tag set includes 'RCE' and 'Authentication Bypass'; the RCE here is strictly local, in the context of the service account (not remote network RCE) - do not treat it as remotely exploitable. |
| Exploit ScenarioDerived | An attacker who already has an unprivileged shell on a system running NoMachine recovers or predicts the weakly-generated Redis authentication credentials (insufficient entropy, CWE-331), authenticates to the local Redis instance, and abuses that access to run code as the higher-privileged NoMachine service account. No public exploit code is identified at time of analysis, but the low attack complexity makes reliable exploitation plausible once the credential-generation weakness is understood. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Local privilege escalation in NoMachine allows an attacker who already has low-privileged code execution on the host to abuse predictably generated Redis database credentials and execute arbitrary code in the context of the service account. The flaw is CWE-331 insufficient entropy in the authentication mechanism for NoMachine's bundled Redis database, rated CVSS 7.8 with a local vector requiring low privileges but no user interaction. The supplied intelligence did not include a CISA KEV entry or public exploit code, so no public exploit was identified at time of analysis; risk is bounded because an initial local foothold is mandatory and no remote network vector exists.
RemediationAI
No vendor-released patch or exact fixed version is identified in the provided data, so consult NoMachine and the ZDI advisory ZDI-26-711 (https://www.zerodayinitiative.com/advisories/ZDI-26-711/) for an updated release and apply it as soon as it is available. Until a fix is applied, reduce the mandatory local foothold: restrict interactive logon and low-privileged code execution on NoMachine hosts to trusted users; disable or stop the bundled Redis service if NoMachine features do not require it (side effect: dependent features may fail); restrict access to the Redis socket or port with OS controls so only the NoMachine service account can connect (side effect: misconfiguration can break NoMachine operations); rotate or regenerate Redis credentials if the product exposes a supported mechanism and verify high entropy (side effect: service restart required); run NoMachine under a least-privileged service account; and monitor for unexpected local Redis connections or child processes spawned by the NoMachine service account. These are compensating controls, not substitutes for the vendor fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NoMachine uses a bundled Redis database and relies on an authentication mechanism whose credentials are generated with insufficient entropy (CWE-331). Because those credentials are predictable or guessable, a local attacker who can already execute low-privileged code can authenticate to the Redis instance and pivot into the NoMachine service account, leading to privilege escalation and arbitrary code execution. The CVSS 3.0/3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms the attack is local, requires low privileges, needs no user interaction, and has high confidentiality, integrity, and availability impact; it does not provide a remote network path. The CPE cpe:2.3:a:nomachine:nomachine:*:*:*:*:*:*:*:* uses a wildcard version, and the provided data does not identify a precise affected or fixed release, so the ZDI advisory ZDI-26-711 should be consulted for version specifics. This is a genuine but bounded issue: the vulnerable Redis credential generation is the enabling condition, while the need for an existing local unprivileged foothold confines practical exposure to multi-user or already-compromised hosts.
Know when Nomachine gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local foothold needed (AV:L) with an existing low-privileged account (PR:L); predictable credentials make exploitation low-complexity (AC:L), and code execution as the service account yields full C/I/A impact.
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
DescriptionCVE.org
NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the authentication mechanism controlling access to the Redis database. The issue results from using insufficient entropy in the generation of credentials. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-30984.
Articles & Coverage 1
Executive ViewAI
A high-severity local privilege-escalation flaw (CVE-2026-92209) in NoMachine's bundled Redis database lets anyone who already holds a low-privileged foothold on a host escalate into the NoMachine service account and run code there, because the database credentials are generated with insufficient randomness. The affected systems are typically the remote-access gateways and admin jump hosts that security and IT teams depend on, so a successful escalation could turn a minor malware infection into persistent, trusted-access compromise of a sensitive tier. No vendor patch is available yet, which means exposure persists on every host running the bundled Redis component until mitigation or a fix ships.
No vendor patch is available. Interim mitigations: restrict the bundled Redis instance to localhost/loopback and firewall it from other hosts; eliminate or tightly control local code execution on NoMachine hosts so the prerequisite foothold is harder to obtain; run NoMachine services under least-privilege accounts with no broader access than required; monitor for anomalous Redis authentication, service-account process creation, and unexpected child processes of NoMachine services; isolate or replace the bundled Redis component on the highest-value remote-access and jump hosts until a vendor fix is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
An unspecified server utility in NoMachine before 5.3.10 on Mac OS X and Linux allows authenticated users to gain privil
An arbitrary file overwrite vulnerability in NoMachine Free Edition and Enterprise Client for macOS before v8.8.1 allows
NoMachine Enterprise Client is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low a
NoMachine Enterprise Client is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low at
NoMachine Cloud Server is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack
NoMachine Cloud Server is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack
NoMachine Enterprise Desktop is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low
NoMachine Enterprise Desktop is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low a
NoMachine Server is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack compl
NoMachine Server is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack comple
NoMachine before 5.3.27 and 6.x before 6.3.6 allows attackers to gain privileges via a Trojan horse wintab32.dll file lo
An uninitialised stack variable in the nxfuse component that is part of the Open Source DokanFS library shipped with NoM
Exploit-DB