What is the CVSS score of EUVD-2026-21651?

EUVD-2026-21651 has a CVSS 3.0 base score of 7.1 (High). CVSS vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Nomachine are affected by EUVD-2026-21651?

CVE-2026-5053 affects NoMachine remote desktop software, allowing authenticated local users to delete arbitrary system files with root privileges through environment variable manipulation.

How to fix or mitigate EUVD-2026-21651?

Within 24 hours: Inventory all systems running NoMachine and document versions in use; notify NoMachine administrators of vulnerability. Within 7 days: Implement access controls restricting local login privileges on NoMachine hosts; disable NoMachine on non-essential systems pending patch availability. Within 30 days: Monitor NoMachine vendor advisories for patch release; prepare deployment procedure for patched version once available; conduct privilege access reviews for accounts with NoMachine local access.

Nomachine EUVD-2026-21651

| CVE-2026-5053 HIGH

External Control of File Name or Path (CWE-73)

2026-04-11 zdi

RCE Nomachine

7.1

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Apr 11, 2026 - 01:00 euvd

EUVD-2026-21651

Analysis Generated

Apr 11, 2026 - 01:00 vuln.today

CVE Published

Apr 11, 2026 - 00:14 nvd

HIGH 7.1

DescriptionCVE.org

NoMachine External Control of File Path Arbitrary File Deletion Vulnerability. This vulnerability allows local attackers to delete arbitrary files on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the handling of environment variables. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files in the context of root. Was ZDI-CAN-28644.

AnalysisAI

Arbitrary file deletion in NoMachine through environment variable path manipulation allows authenticated local attackers to delete system files with root privileges. Vulnerability stems from insufficient validation of user-supplied paths in file operations, enabling low-privileged users to escalate impact by removing critical files. Affects NoMachine cross-platform remote desktop software. No public exploit identified at time of analysis.

Technical ContextAI

CWE-73 external control of file path flaw in environment variable processing. Attacker-controlled path values bypass validation checks before file system operations execute under elevated root context, enabling unauthorized file deletion outside intended scope.

RemediationAI

No vendor-released patch identified at time of analysis. Organizations should monitor NoMachine vendor advisory channels and apply updates immediately upon release. Interim mitigations: restrict local access to NoMachine installations through operating system permissions, enforce principle of least privilege for user accounts, implement file integrity monitoring for critical system paths, and audit environment variable usage in NoMachine configurations. Review ZDI advisory for vendor coordination status: https://www.zerodayinitiative.com/advisories/ZDI-26-247/. Disable NoMachine service on systems where remote desktop functionality is not operationally required until patched version becomes available.