Local Privilege Escalation Vulnerability in NoMachine by NoMachine
CVE-2026-5054

7.8HIGH

Key Information:

Vendor

Nomachine

Status
Nomachine
Vendor
CVE Published:
11 April 2026

What is CVE-2026-5054?

This vulnerability in NoMachine involves improper validation of user-supplied file paths during command line operations. Local attackers can exploit this flaw by executing low-privileged code, leading to unauthorized privilege escalation and the potential execution of arbitrary code within a root context. This poses significant risks to the integrity and confidentiality of the affected systems.

Affected Version(s)

NoMachine 9.3.7

References

https://www.zerodayinitiative.com/advisories/ZDI-26-248/
x_research-advisory

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.