NoMachine nxhtd EUVD-2026-107399

Exploitation requires network reachability to the NoMachine nxhtd web service (stated as listening on port 4443 by default) and no authentication (CVSS PR:N), so a default installation exposing this service to an attacker is sufficient. The flaw is triggered by supplying an unvalidated URI that the service then fetches. Limiting factors: the attacker must be able to reach the nxhtd listener (network segmentation, firewalling, or binding the service to localhost/trusted interfaces would curtail exposure), and impact is bounded to LOW confidentiality/integrity - the attacker gains the ability to make requests in the service account's context and read accessible responses, not direct code execution or data destruction.

This is a moderate-priority issue rather than a critical emergency. The CVSS 3.0 vector (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) describes a network-reachable, low-complexity, unauthenticated SSRF (CWE-918) with a scope change but only LOW confidentiality and LOW integrity impact and no availability impact - consistent with a server-side request forgery that pivots through the service rather than directly compromising it. No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is NOT on CISA KEV, and no public exploit code is referenced; it was reported through ZDI (ZDI-26-712 / ZDI-CAN-31619), which typically indicates coordinated disclosure rather than observed in-the-wild attacks. Signals are therefore internally consistent (network/unauthenticated per CVSS matches the description's 'Authentication is not required'), with the main caveat that the description states the web service listens on 'UDP port 4443 by default,' which is unusual for an HTTP/web service and may be a transcription error in the advisory - verify the actual port/protocol with NoMachine. Overall: a real, remotely reachable unauthenticated flaw worth patching, but the limited (LOW) technical impact and absence of KEV/POC/EPSS signals place it below actively-exploited critical RCEs in priority.

A remote, unauthenticated attacker sends a crafted request to the NoMachine nxhtd web service containing an attacker-controlled URI. Because the service fails to validate the URI before accessing the resource, it issues the request on the attacker's behalf in the context of the service account, letting the attacker reach internal network resources or read responses the server can access. No public proof-of-concept exploit was identified in the provided data.