CVE-2026-53694
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
An Argument Injection vulnerability was found in NoMachine before versions 9.5.7 and 8.23.2. The flaw is due to improper neutralization of argument delimiters in a command, allowing an attacker to inject malicious arguments.
Risk Assessment
An attacker can remotely execute arbitrary commands in the context of the NoMachine application, leading to system compromise, data theft, or privilege escalation.
Recommendation
Immediately update NoMachine to version 9.5.7 or later (for 9.x) and to version 8.23.2 or later (for 8.x).
Other vulnerabilities in NoMachine
See all- CVE-2017-12763High
An unspecified server utility in NoMachine before version 5.3.10 on Mac OS X and Linux allows authenticated users to gain privileges by accessing local files.
- CVE-2026-18264High
Vulnerability in NoMachine in the getstat service is due to lack of proper validation of a user-supplied string before using it to execute a system call. A remote authenticated attacker can exploit this flaw to execute arbitrary code in the context of the service account.
Original NVD description (English source)
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Nomachine allows Argument Injection.This issue affects Nomachine: before 9.5.7, before 8.23.2.