Zero Day Initiative Discloses NoMachine Privilege Escalation Vulnerability
A local privilege escalation vulnerability in NoMachine, identified as ZDI-26-774 and CVE-2026-111185, allows attackers with low-privileged access to gain elevated permissions.
Zero Day Initiative (ZDI) has publicly disclosed a significant local privilege escalation vulnerability affecting installations of the remote desktop software NoMachine. The vulnerability, tracked as ZDI-26-774 and assigned CVE-2026-111185, carries a CVSS score of 7.8, indicating a high severity risk.
Successful exploitation of this flaw requires an attacker to first achieve low-privileged code execution on the target system. This prerequisite means the vulnerability is not directly exploitable by unauthenticated remote attackers but poses a substantial threat to systems already compromised by less severe malware or user-level access.
The core of the vulnerability lies within the NoMachine Device Server component. Specifically, the software improperly loads a library from an unsecured location on the file system. This insecure loading mechanism allows an attacker who has already gained a foothold on the system to manipulate the loading process.
By exploiting this uncontrolled search path element, an attacker can trick the NoMachine Device Server into loading a malicious library. This would enable the attacker to execute arbitrary code within the context of the service account running the NoMachine server, effectively escalating their privileges from low-level user to a more privileged system context.
NoMachine has addressed this vulnerability by releasing patches in versions 10, 9, and 8 of its software. Users are strongly advised to update to the latest available versions to mitigate the risk. The advisory from ZDI highlights the importance of secure library loading practices and the potential for privilege escalation even when initial access is limited.
The disclosure timeline indicates that the vulnerability was reported to the vendor on July 29, 2026, with a coordinated public release of the advisory on October 15, 2026. This timeline reflects a standard practice for responsible vulnerability disclosure, allowing vendors sufficient time to develop and distribute patches.
The vulnerability was discovered by researcher khongtrang. This disclosure serves as a reminder for organizations to maintain up-to-date software inventories and promptly apply security patches, especially for software that operates with elevated privileges or handles sensitive network connections.
This finding underscores the ongoing challenge of securing complex software environments. Even well-established applications can harbor vulnerabilities that, when combined with other security weaknesses, can lead to significant compromise. Prompt patching and diligent security hygiene remain critical defenses against such threats.
This advisory, ZDI-26-773, details a local privilege escalation vulnerability in NoMachine's Device Service, specifically related to incorrect permissions on a named pipe. While the previous story, ZDI-26-774, also covered a NoMachine privilege escalation, this new vulnerability (CVE-2026-111184) is distinct and requires prior low-privilege code execution to exploit, allowing an attacker to achieve SYSTEM-level privileges. The issue has been patched in NoMachine versions 10, 9, and 8.