NoMachine nxhtd Server-Side Request Forgery Vulnerability Allows Unauthenticated Exploitation
A critical server-side request forgery (SSRF) vulnerability in NoMachine's nxhtd server allows unauthenticated attackers to initiate arbitrary requests, potentially leading to information disclosure.
A significant security vulnerability has been identified in NoMachine's nxhtd server, a component responsible for handling remote connections. The flaw, cataloged as CVE-2026-92210, is a server-side request forgery (SSRF) that allows attackers to trick the server into making arbitrary network requests on their behalf. Crucially, exploitation of this vulnerability does not require any form of authentication, making it accessible to a wide range of malicious actors.
The vulnerability resides within the web service component of nxhtd, which by default listens on UDP port 4443. The root cause of the issue is the improper validation of Uniform Resource Identifiers (URIs) before the server attempts to access the requested resources. By crafting a malicious URI, an attacker can manipulate the nxhtd server into initiating requests to internal or external network resources that the server itself has access to. This can be done in the context of the service account running NoMachine, potentially granting attackers elevated privileges or access to sensitive internal systems.
The Zero Day Initiative (ZDI), which disclosed the vulnerability, has assigned it a CVSS score of 7.2, classifying it as high severity. This score reflects the potential impact of the vulnerability, which can range from network reconnaissance and internal network mapping to the exfiltration of sensitive data or even the initiation of further attacks against other systems within the compromised network. The lack of authentication requirement significantly lowers the barrier to entry for exploitation.
NoMachine has addressed this vulnerability by releasing patches in several of its product lines. Specifically, versions v10.1.7, v9.9.6, and v8.27.1 now contain fixes for CVE-2026-92210. Users of NoMachine are strongly advised to update their installations to the latest available versions to mitigate the risk of exploitation. The company's knowledge base article https://kb.nomachine.com/software-updates provides further details on the software updates.
The disclosure timeline indicates that the vulnerability was first reported to the vendor on August 7, 2026. Following a coordinated disclosure process, the advisory was publicly released on September 16, 2026, with an update to the advisory on the same day. This structured approach ensures that users have sufficient time to apply patches before the vulnerability details become widely known, although the unauthenticated nature of the exploit still poses a significant risk.
This SSRF vulnerability highlights a common class of security flaws where insufficient validation of user-supplied input, particularly URIs, can lead to dangerous consequences. In this case, the ability for an unauthenticated attacker to force the server to make arbitrary requests is a serious concern for any organization using NoMachine for remote access or management. The impact could be far-reaching, depending on the network segmentation and security posture of the affected environment.
Niels Pfau from Mantodea Security GmbH is credited with discovering and reporting this vulnerability. The coordinated disclosure by ZDI and the prompt patching by NoMachine demonstrate a positive security response, but the inherent risk of SSRF vulnerabilities means that continuous vigilance and timely updates remain paramount for maintaining a secure infrastructure.
This advisory details a heap-based buffer overflow vulnerability in NoMachine's mDNS service, assigned CVE-2026-92208. Unlike the previously reported SSRF vulnerability in the nxhtd server, this flaw allows for remote code execution without authentication, affecting network-adjacent attackers. The vulnerability stems from improper validation of mDNS resource record lengths, enabling attackers to overwrite heap buffers and execute code in the context of the service account.