Server-Side Request Forgery Vulnerability in NoMachine Software
CVE-2026-92210

7.2HIGH

Key Information:

Vendor

Nomachine

Status
Nomachine
Vendor
CVE Published:
21 October 2026

What is CVE-2026-92210?

The NoMachine nxhtd product is susceptible to a Server-Side Request Forgery (SSRF) vulnerability, enabling remote attackers to trigger arbitrary server-side requests. This flaw is caused by an inadequacy in URI validation within the web service, which operates by default on UDP port 4443. Attackers can exploit this vulnerability to perform unauthorized requests in the context of the service account, potentially leading to sensitive information being disclosed.

Affected Version(s)

NoMachine nomachine_9.8.2_1_amd64.deb

References

https://www.zerodayinitiative.com/advisories/ZDI-26-712/
x_research-advisory

CVSS V3.0

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.