NoMachine Suffers Remote Code Execution Vulnerability in getstat Command
A critical vulnerability in NoMachine's getstat command allows authenticated attackers to achieve remote code execution with a CVSS score of 8.8.
Zero Day Initiative (ZDI) has disclosed a significant remote code execution (RCE) vulnerability affecting NoMachine, a popular remote desktop software. The flaw, identified as ZDI-26-483 and assigned CVE-2026-18264, carries a high CVSS score of 8.8, indicating a severe security risk.
The vulnerability resides within NoMachine's web service, which typically listens on TCP port 4000. Attackers who can authenticate to the affected system can exploit this flaw by sending specially crafted input to the getstat command. The root cause is the insufficient validation of user-supplied strings before they are used in system calls, allowing an attacker to inject malicious commands.
Successful exploitation of this vulnerability enables an attacker to execute arbitrary code on the target system. Crucially, this code runs with the same privileges as the NoMachine service account, which can often be a highly privileged user, potentially leading to a full system compromise. The requirement for authentication means that attackers cannot exploit this vulnerability against unauthenticated systems, but any authenticated user on a vulnerable system could be at risk.
NoMachine has responded promptly to the disclosure by releasing an update to address the vulnerability. Users are strongly advised to apply the patch as soon as possible to mitigate the risk of exploitation. Further details regarding the fix and affected versions can be found in NoMachine's official knowledge base article, TR06X11869.
The disclosure timeline indicates that the vulnerability was reported to the vendor on July 24, 2026, and the coordinated public release of the advisory occurred on July 29, 2026. This rapid response from both ZDI and NoMachine highlights the severity of the issue and the collaborative effort to secure users.
The vulnerability was discovered and reported by security researcher Sajeeb Lohani. His work underscores the ongoing importance of independent security research in identifying and mitigating critical vulnerabilities before they can be widely exploited by malicious actors.
This RCE vulnerability in NoMachine adds to the growing list of critical security flaws discovered in widely used software. Organizations relying on NoMachine for remote access should prioritize patching to prevent potential breaches and unauthorized access to their systems.