NoMachine Local Privilege Escalation Via Uncontrolled Search Path
A CVSS 7.8 flaw in NoMachine allows local attackers to gain higher privileges, requiring initial code execution on the target system.
Key points
- Zero Day Initiative rated the vulnerability at CVSS 7.8.
- The flaw is identified as an uncontrolled search path element.
- Exploitation requires prior low-privileged code execution.
The Zero Day Initiative has disclosed a local privilege escalation vulnerability in NoMachine remote access software. This flaw, tracked as CVE-2026-111185, allows attackers to elevate their access rights on affected systems.
What happened
Zero Day Initiative published advisory ZDI-26-774 detailing the issue in NoMachine installations. The vulnerability stems from an uncontrolled search path element within the application. An attacker must first achieve the ability to execute low-privileged code on the target machine. Once this initial foothold is secured, the flaw permits escalation to higher privileges. The ZDI assigned a CVSS score of 7.8 to this specific issue.
Why it matters
This vulnerability exposes environments where NoMachine is deployed for remote management. Local attackers who compromise a standard user account can potentially leverage this flaw. The requirement for initial code execution mitigates remote exploitation risks. However, any breach of the perimeter or user account increases exposure. Defenders must monitor for unusual privilege changes in NoMachine sessions.
Next steps
- Verify current NoMachine versions against vendor advisories.
- Restrict local user permissions on systems running NoMachine.
- Monitor logs for unexpected privilege elevation events.
- Ensure endpoint detection tools are updated for this behaviour.
Detection notes
Security teams should examine process creation logs for anomalous parent-child relationships involving NoMachine binaries. Look for unexpected elevation of user tokens or group memberships. Check for new administrative accounts created shortly after initial access. Monitor for unusual file access patterns in system directories during active sessions. Validate that service accounts are not being used for interactive logins. Review audit trails for any configuration changes made by low-privileged users. Ensure logging captures command-line arguments for all NoMachine processes.
What to do and how to stay safe: NoMachine
- Audit all systems running NoMachine for unauthorized local accounts.
- Implement strict least-privilege policies for users accessing remote sessions.
- Enable detailed process monitoring to detect unusual binary executions.
- Wait for the vendor to provide an official update before applying patches.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production
General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for the NoMachine vulnerability?
The Zero Day Initiative assigned a CVSS rating of 7.8 to this vulnerability.
What conditions are required to exploit this flaw?
An attacker must first obtain the ability to execute low-privileged code on the target system.
Is there a CVE ID for this issue?
Yes, the assigned CVE ID is CVE-2026-111185.
