NoMachine vulnerabilities
We track 14 vulnerabilities in NoMachine products across 3 products. 14 are rated high or critical, and none are known to be exploited. The most recent was published on November 4, 2026.
Latest NoMachine vulnerabilities
- 9.8 Critical severity
NoMachine: Heap-based Buffer Overflow
NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. The
- 7.2 High severity
NoMachine: Server-Side Request Forgery
NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of NoMachine. Authentication is not required to exploit this vulne
- 7.8 High severity
NoMachine: Insufficient Entropy
NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code
- 8.8 High severity
NoMachine: Heap-based Buffer Overflow
NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability.
- 7.8 High severity
NoMachine: Incorrect Permission Assignment for Critical Resource
NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-pri
- 8.8 High severity
NoMachine: Improper Neutralization of Special Elements used in an OS Command
NoMachine getstat Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is required to exploit this vulnerability. The specific flaw ex
- 7.3 High severity
NoMachine: Improper Neutralization of Argument Delimiters in a Command
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Nomachine allows Argument Injection.This issue affects Nomachine: before 9.5.7, before 8.23.2.
- 7.8 High severity
NoMachine: Uncontrolled Search Path Element
NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged co
- 7.8 High severity
NoMachine: External Control of File Name or Path
NoMachine External Control of File Path Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code
- 7.1 High severity
NoMachine: External Control of File Name or Path
NoMachine External Control of File Path Arbitrary File Deletion Vulnerability. This vulnerability allows local attackers to delete arbitrary files on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code
- 7.8 High severity
NoMachine: Uncontrolled Search Path Element
NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged co
- 7.8 High severity
NoMachine: Uncontrolled Search Path Element
NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged co
- 9.1 Critical severity
enterprise_client: Improper Link Resolution Before File Access
An arbitrary file overwrite vulnerability in NoMachine Free Edition and Enterprise Client for macOS before v8.8.1 allows attackers to overwrite root-owned files by using hardlinks.
- 7.3 High severity
Nomachine: Incorrect Permission Assignment for Critical Resource
Incorrect permissions for the folder C:\ProgramData\NoMachine\var\uninstall of Nomachine v7.9.2 allows attackers to perform a DLL hijacking attack and execute arbitrary code.