CVE-2025-8614
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The flaw exists within the configuration of OpenSSL, which loads a configuration file from an unsecured location, allowing escalation to the service account.
Risk Assessment
An attacker with low-privileged code execution on a NoMachine installation can exploit the insecure OpenSSL configuration file location to escalate privileges and execute arbitrary code as the service account.
Recommendation
Update NoMachine to a version containing the fix for this vulnerability. Restrict the ability of unprivileged users to execute code on systems running NoMachine.
Other vulnerabilities in NoMachine
See all- CVE-2017-12763High
An unspecified server utility in NoMachine before version 5.3.10 on Mac OS X and Linux allows authenticated users to gain privileges by accessing local files.
- CVE-2026-92209High
The authentication mechanism controlling access to the Redis database in NoMachine uses insufficient entropy when generating credentials. A local attacker able to execute low-privileged code can exploit this to escalate privileges and execute arbitrary code in the context of the service account.
- CVE-2026-92208High
NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NoMachine without authentication. The flaw exists in the parsing of mDNS resource records due to lack of proper validation of user-supplied data length before copying to a heap-based buffer.
- CVE-2026-111184High
The vulnerability in NoMachine Device Service stems from incorrect permissions on a named pipe. A local attacker able to execute low-privileged code can exploit this flaw to escalate privileges and execute arbitrary code in the context of SYSTEM.
- CVE-2026-18264High
Vulnerability in NoMachine in the getstat service is due to lack of proper validation of a user-supplied string before using it to execute a system call. A remote authenticated attacker can exploit this flaw to execute arbitrary code in the context of the service account.
- CVE-2026-53694High
An Argument Injection vulnerability was found in NoMachine before versions 9.5.7 and 8.23.2. The flaw is due to improper neutralization of argument delimiters in a command, allowing an attacker to inject malicious arguments.
Original NVD description (English source)
NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of OpenSSL. The product loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-26766.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS