ZDI-26-774: NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-111185.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must already be able to execute code with low privileges on an affected NoMachine installation. It is a local privilege-escalation issue, so the provided information does not indicate exploitation directly from an unauthenticated remote position.
What is the potential impact after exploitation?
A successful attacker can escalate privileges on the affected system. ZDI assigned the issue a CVSS score of 7.8.
How can I identify this issue in vulnerability tracking?
The assigned CVE is CVE-2026-111185. The ZDI advisory identifier is ZDI-26-774.