EUVD-2026-21653
GHSA-4399-fg4g-454c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessExecute low-privileged code on target
-
ExploitCraft malicious command line parameter
-
ExecutionBypass path validation in NoMachine
-
ImpactEscalate to privileged code execution
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File name/path control
|
| Exploitation Conditions | Attacker requires low-privilege local code execution on the target system running NoMachine. No user interaction needed. Vulnerability exploited via unvalidated command-line parameters to NoMachine processes, affecting all default installations where low-privileged users can execute code. |
| Impact | Local privilege escalation from low-privileged user to root via unvalidated file path handling. CVSS 7.8 reflects high impact (confidentiality, integrity, availability) but requires local code execution access. EPSS and KEV status unknown; prioritize if NoMachine runs with elevated privileges in your environment or handles untrusted user input. |
| Exploit ScenarioDerived | Attacker with local user access crafts malicious command-line parameter with path traversal to NoMachine process. Unvalidated path directs file operation to privileged location, achieving root code execution. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 11, 2026
Local privilege escalation in NoMachine allows authenticated low-privileged attackers to execute arbitrary code as root through improper validation of command line path parameters. The vulnerability stems from insufficient sanitization of user-supplied file paths in file operations, enabling path traversal to manipulate privileged system resources. Exploitation requires existing low-privileged code execution on the target system. CVSS 7.8 (High) reflects local attack vector with low complexity and no user interaction required. No public exploit identified at time of analysis.
RemediationAI
Patch available per vendor advisory. Consult Zero Day Initiative advisory ZDI-26-248 at https://www.zerodayinitiative.com/advisories/ZDI-26-248/ for patched version details and deployment guidance. Until patch applied, restrict local user access to trusted accounts only, enforce least privilege principles, and monitor command line arguments passed to NoMachine service processes for suspicious path patterns. Implement application whitelisting to prevent unauthorized low-privileged code execution. Disable NoMachine service on non-essential systems. Review file operation audit logs for unexpected privileged file access patterns indicating exploitation attempts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-73 (External Control of File Name or Path) exploitation through command line parameter processing. Lack of canonical path validation enables attacker-controlled file path to redirect file operations, likely abusing symbolic links or directory traversal sequences to write/modify privileged files. Root context execution achieved through service/daemon interaction with unsanitized paths.
Know when Nomachine gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
NoMachine External Control of File Path Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the handling of command line parameters. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-28630.
Executive ViewAI
CVE-2026-5054 is a local privilege escalation vulnerability in NoMachine that allows low-privileged users already present on a system to execute arbitrary code with root privileges through path traversal attacks. Organizations using NoMachine for remote access should prioritize identifying affected systems, as this vulnerability could enable lateral movement and persistence for attackers who have already compromised user accounts or gained initial system access.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict NoMachine access to trusted administrative users only via access control lists; (2) Enable mandatory auditing of all privilege escalation attempts and file access in sensitive directories; (3) Deploy application whitelisting to prevent execution of unauthorized binaries; (4) Monitor NoMachine process execution and file I/O operations for path traversal indicators; (5) Consider temporary network isolation of non-critical NoMachine systems until patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Related Vulnerabilities in NoMachine Local Privilege Escalation
View all 3An unspecified server utility in NoMachine before 5.3.10 on Mac OS X and Linux allows authenticated users to gain privil
An arbitrary file overwrite vulnerability in NoMachine Free Edition and Enterprise Client for macOS before v8.8.1 allows
NoMachine Enterprise Client is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low a
NoMachine Enterprise Client is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low at
NoMachine Cloud Server is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack
NoMachine Cloud Server is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack
NoMachine Enterprise Desktop is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low
NoMachine Enterprise Desktop is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low a
NoMachine Server is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack compl
NoMachine Server is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack comple
NoMachine before 5.3.27 and 6.x before 6.3.6 allows attackers to gain privileges via a Trojan horse wintab32.dll file lo
An uninitialised stack variable in the nxfuse component that is part of the Open Source DokanFS library shipped with NoM
Exploit-DB