CVE-2026-18264: NoMachine getstat Command Injection Remote Code Execution Vulnerability
NoMachine getstat Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is required to exploit this vulnerability.
The specific flaw exists within the web service, which listens on TCP port 4000 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. . Was ZDI-CAN-30634.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to the NoMachine web service that listens on TCP port 4000 by default (e.g., allow only trusted IPs via firewall/ACL) to reduce exposure to remote attackers.
- Compensating control
Because exploitation requires authentication, ensure only authorized users can access the NoMachine web service (TCP port 4000) and apply strong authentication controls to prevent authenticated misuse.
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Affected NoMachine installations with the web service reachable by an attacker are exposed. The web service listens on TCP port 4000 by default.
What does an attacker need to exploit it?
The attacker needs valid authentication to the affected NoMachine installation. No user interaction is required, and the attack can be performed remotely over the network.
What level of access can exploitation provide?
Successful exploitation allows arbitrary code execution in the context of the NoMachine service account. The vulnerability affects confidentiality, integrity, and availability.
What can be done while patching is not immediately possible?
Limit network access to the NoMachine web service, particularly TCP port 4000, to trusted authenticated users and networks. This reduces the set of attackers able to reach the vulnerable service.