NoMachine EUVD-2026-36060

The CVSS 4.0 vector requires the attacker to already have a local low-privileged account on the NoMachine host (AV:L, PR:L) and to be able to invoke the vulnerable NoMachine entry point that passes user input into a child process command line; AT:P indicates an additional attack requirement beyond the attacker's control, which the public description does not disclose and which should be read from the NoMachine knowledge-base articles SU05X00274 and SU05X00275. Exploitation is limited to systems running NoMachine versions prior to 9.5.7 (9.x branch) or 8.23.2 (8.x branch); it does not require user interaction (UI:N) and cannot be launched purely over the network without first obtaining a local shell. Hosts where untrusted users cannot obtain local logon (single-user workstations with full-disk encryption, kiosks without shell access) are not realistically reachable.

The CVSS 4.0 vector AV:L/AC:L/AT:P/PR:L/UI:N with VC:H/VI:H/VA:H produces a 7.3 (High) and tells a consistent story: a local, low-privileged user can, with low complexity but in the presence of a specific attack precondition (AT:P), achieve full CIA compromise of the vulnerable component without user interaction; scope to other systems is unchanged. No EPSS score, KEV listing, or public PoC was supplied with this record, so realistic exploitation likelihood cannot be quantified from the inputs and there is no evidence of active exploitation. The practical priority is moderate-to-high for multi-user workstations, jump hosts, and shared lab/VDI systems where untrusted local accounts coexist with NoMachine, and lower for single-user endpoints where the attacker already controls the only interactive account. The AT:P flag combined with the sparse description means the exact triggering configuration is not disclosed in the available data and should be confirmed against the vendor knowledge-base articles before tuning detections.

A low-privileged local user on a shared Linux or Windows host running an unpatched NoMachine installation invokes a NoMachine client, helper, or CLI entry point with a value crafted to contain an argument delimiter (for example a leading hyphen or shell-style option), which is passed unsanitized into a privileged child process. The injected flag changes the child's behavior - for example forcing it to read an attacker-controlled config file, execute a chosen binary, or write to a sensitive path - yielding code execution or data access at the elevated privilege level of the NoMachine component. No public PoC has been identified at time of analysis.