EUVD-2026-21654
GHSA-cfcr-ph9h-pgwq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local code execution with low privileges
-
DeliveryPlace malicious library in unsecured search path
-
ExploitNoMachine Device Server loads crafted library
-
ExecutionEscalate privileges to SYSTEM context
-
ImpactExecute arbitrary code with elevated rights
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V13 - Configuration Search path element control
|
| Exploitation Conditions | Attacker requires low-privilege local code execution on the target system running NoMachine Device Server. The NoMachine service must load a library from an unsecured directory. No user interaction needed. Escalates to SYSTEM privileges. |
| Impact | CVSS 7.8 reflects high impact (confidentiality, integrity, availability) with local attack vector and low complexity. Requires prior low-privilege code execution. EPSS and KEV status unknown; limited public visibility suggests low observed exploitation activity currently. Priority depends on NoMachine deployment density in target environment and whether initial code execution vector is readily available. |
| Exploit ScenarioDerived | Attacker with local code execution privileges exploits insecure library loading in NoMachine Device Server to achieve SYSTEM-level privilege escalation. Leverages uncontrolled search path (CWE-427) to inject malicious library; no public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 11, 2026
Local privilege escalation in NoMachine Device Server allows authenticated low-privileged attackers to execute arbitrary code with SYSTEM privileges by exploiting unsafe library loading from an unsecured search path. The vulnerability (ZDI-CAN-28494) requires prior local access but enables full system compromise through DLL hijacking or similar path manipulation. No KEV listing or public exploit identified at time of analysis. CVSS 7.8 (High) with attack vector requiring local access and low privileges (AV:L/PR:L).
RemediationAI
No vendor-released patch identified at time of analysis. Consult Zero Day Initiative advisory ZDI-26-249 at https://www.zerodayinitiative.com/advisories/ZDI-26-249/ for vendor coordination timeline and patch availability status. Interim workarounds: restrict local user access to NoMachine installation directories using NTFS permissions, disable NoMachine Device Server component if not operationally required, implement application whitelisting to prevent unauthorized DLL loading, and monitor system directories for unexpected library file creation. Deploy endpoint detection solutions configured to alert on privilege escalation attempts targeting service contexts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-427 (Uncontrolled Search Path Element) vulnerability in NoMachine Device Server component. The service loads libraries from directories where unprivileged users can write files, creating a DLL hijacking condition. Exploitation requires planting a malicious library in the search path before service initialization or restart, achieving SYSTEM-level code execution through trusted service context.
Know when Nomachine gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the NoMachine Device Server. The product loads a library from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-28494.
Executive ViewAI
CVE-2026-5055 affects NoMachine Device Server and allows authenticated local users to escalate privileges to SYSTEM level through unsafe library loading, enabling complete system compromise. Organizations running NoMachine Device Server must immediately assess internal user access controls, as any low-privileged employee or contractor with local system access can gain administrative control. This vulnerability requires urgent mitigation since no vendor patch is currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict local system access and remote desktop sessions to administrative personnel only; (2) Disable unnecessary NoMachine services if not actively required; (3) Monitor system privilege escalation events and DLL load operations through Windows Event Viewer and endpoint detection tools; (4) Apply Windows UAC hardening to prevent low-privilege code execution; (5) Use application whitelisting to prevent unauthorized DLL loading from user-writable paths; (6) Isolate NoMachine Device Server systems on segmented networks with restricted lateral movement.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Related Vulnerabilities in NoMachine Local Privilege Escalation
View all 3An unspecified server utility in NoMachine before 5.3.10 on Mac OS X and Linux allows authenticated users to gain privil
An arbitrary file overwrite vulnerability in NoMachine Free Edition and Enterprise Client for macOS before v8.8.1 allows
NoMachine Enterprise Client is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low a
NoMachine Enterprise Client is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low at
NoMachine Cloud Server is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack
NoMachine Cloud Server is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack
NoMachine Enterprise Desktop is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low
NoMachine Enterprise Desktop is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low a
NoMachine Server is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack compl
NoMachine Server is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack comple
NoMachine before 5.3.27 and 6.x before 6.3.6 allows attackers to gain privileges via a Trojan horse wintab32.dll file lo
An uninitialised stack variable in the nxfuse component that is part of the Open Source DokanFS library shipped with NoM
Exploit-DB