Remote Code Execution Vulnerability in NoMachine Web Service

CVE-2026-18264

What is CVE-2026-18264?

The NoMachine web service is affected by a command injection vulnerability that permits remote attackers to execute arbitrary code. This issue arises from insufficient validation of user-supplied input within system calls executed by the service. Although authentication is required to exploit this flaw, an attacker can leverage it to execute malicious commands under the privileges of the service account. The vulnerability exploits the web service's default listening port, TCP port 4000, raising significant security concerns for deployments.

References