NoMachine Software Vulnerable to Local Privilege Escalation via Improper Authentication
A local privilege escalation vulnerability (CVE-2026-92209) in NoMachine software allows attackers with initial low-privilege code execution to gain higher system privileges.
The Zero Day Initiative (ZDI) has disclosed a critical local privilege escalation vulnerability affecting NoMachine software, identified as ZDI-26-711 and assigned CVE-2026-92209. This flaw allows an attacker who has already gained the ability to execute low-privileged code on a target system to escalate their privileges to a higher level.
The vulnerability stems from an issue within the authentication mechanism that controls access to the Redis database component of NoMachine. Specifically, the problem arises from the use of insufficient entropy during the generation of credentials. This weakness can be exploited by an attacker to bypass authentication controls and gain elevated privileges, ultimately allowing them to execute arbitrary code within the context of the service account.
With higher privileges, an attacker could potentially access sensitive system files, install malicious software, or disrupt system operations. The CVSS score assigned to this vulnerability is 7.8, indicating a high severity level. This type of vulnerability is particularly concerning as it can be chained with other exploits that grant initial low-privilege access, leading to a full system compromise.
NoMachine has addressed this vulnerability by releasing updated versions of its software. The fix is included in NoMachine versions 10.1.7, 9.9.6, and 8.27.1. Users are strongly advised to update to these patched versions as soon as possible to mitigate the risk of exploitation.
The disclosure timeline indicates that the vulnerability was initially reported to the vendor on July 29, 2026. Following a coordinated disclosure process, the public advisory was released on September 16, 2026, with an update to the advisory on the same day. This timeline suggests a standard responsible disclosure practice.
The discovery and reporting of this vulnerability are credited to Tobias Vonmetz. Such contributions from security researchers are vital in identifying and rectifying security flaws before they can be widely exploited by malicious actors.
This vulnerability highlights the ongoing challenges in securing complex software, particularly concerning authentication mechanisms and credential management. Organizations relying on NoMachine software should prioritize patching to protect their environments from potential exploitation. The ability for an attacker to escalate privileges locally is a common and dangerous attack vector that can lead to significant security breaches.