ZDI-26-483: NoMachine getstat Command Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 4000 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-18264.
— ZDI
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NoMachineto a version that resolves this vulnerability.Patch ZDI-26-483 - Compensating control
Restrict network access to the NoMachine web service that listens on TCP port 4000 by default (e.g., allow only trusted IPs) to reduce exposure to remote command injection attempts.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be able to reach the NoMachine web service and authenticate to it. The web service listens on TCP port 4000 by default, so systems exposing that port to untrusted networks are the most directly exposed.
What level of access could exploitation provide?
Successful exploitation allows arbitrary code execution in the context of the NoMachine service account. The vulnerability affects confidentiality, integrity, and availability according to its CVSS vector.
What can be done while a fix is not yet deployed?
Limit access to the NoMachine web service on TCP port 4000 to trusted networks and trusted authenticated users. Because authentication is required, review and restrict accounts that can access the service.