ZDI-26-711: NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability
Published Sep 16, 2026
·Updated
This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-92209.
Affected Software
1 affected component
NoMachine NoMachine
Event History
Sep 16, 2026
Advisory Published
via ZDI·05:00 AM
Data Sourced
via ZDI·05:00 AM
Description
Frequently Asked Questions
1
Is this vulnerability exploitable remotely without access to the target system?
The available information describes it as a local privilege-escalation issue. An attacker must first be able to execute low-privileged code on the affected system.
2
Which systems are realistically exposed?
Affected NoMachine installations are exposed when an untrusted or compromised user or process can execute low-privileged code locally. The provided information does not identify affected versions or configuration-specific conditions.