ZDI-26-712: NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability
Published Sep 16, 2026
·Updated
This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-92210.
Affected Software
1 affected component
NoMachine NoMachine nxhtd
Event History
Sep 16, 2026
Advisory Published
via ZDI·05:00 AM
Data Sourced
via ZDI·05:00 AM
Description
Frequently Asked Questions
1
Does exploitation require an authenticated NoMachine account?
No. The vulnerability can be exploited remotely without authentication.
2
What can a successful attacker do?
A remote attacker can cause the affected NoMachine nxhtd service to initiate arbitrary server-side requests, which may disclose information accessible from the server's network context.
3
Which component should be prioritized for investigation?
The affected component identified in the available information is NoMachine nxhtd. No affected version range or configuration prerequisites are provided.