ZDI-CAN-30634: ZDI-26-483: NoMachine getstat Command Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 4000 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-18264.
— ZDI
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NoMachineto a version that resolves this vulnerability.Patch ZDI-26-483 - Compensating control
Restrict network access to the NoMachine web service that listens on TCP port 4000 by default (e.g., limit inbound access to trusted IPs via firewall/ACL) until the patch is applied.
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker must authenticate to the affected NoMachine installation. They can then exploit the web service remotely to execute arbitrary code.
Which network exposure should be prioritized during triage?
Prioritize NoMachine web services reachable on TCP port 4000, which is the default listening port identified for the vulnerable component. Restricting access to this service reduces remote exposure, but does not remove the risk from authenticated users who can reach it.
What privileges would successful code execution have?
Code executes in the context of the NoMachine service account. The resulting impact depends on the privileges assigned to that account.