CVE-2026-18264
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk67th percentile - higher than 67% of all known CVEs
Summary
Vulnerability in NoMachine in the getstat service is due to lack of proper validation of a user-supplied string before using it to execute a system call. A remote authenticated attacker can exploit this flaw to execute arbitrary code in the context of the service account.
Risk Assessment
The risk for the organization is the possibility of remote code execution by an authenticated attacker, potentially leading to service compromise and data access.
Recommendation
It is recommended to update NoMachine to the latest version and restrict access to port 4000 to trusted users only.
Other vulnerabilities in NoMachine
See all- CVE-2017-12763High
An unspecified server utility in NoMachine before version 5.3.10 on Mac OS X and Linux allows authenticated users to gain privileges by accessing local files.
- CVE-2026-53694High
An Argument Injection vulnerability was found in NoMachine before versions 9.5.7 and 8.23.2. The flaw is due to improper neutralization of argument delimiters in a command, allowing an attacker to inject malicious arguments.
Original NVD description (English source)
NoMachine getstat Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 4000 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. . Was ZDI-CAN-30634.