NoMachine Fixes Local Privilege Escalation in Versions 8, 9 and 10

NoMachine has released security updates for versions 8, 9 and 10 to address a local privilege escalation vulnerability. The flaw, tracked as CVE-2026-111184, allows attackers with low-privileged code execution to gain full SYSTEM control.

What happened

Zero Day Initiative reported this vulnerability to the vendor on August 7, 2026. The coordinated public advisory followed on October 15, 2026, alongside the availability of fixes. The issue resides within the NoMachine Device Service component of the remote desktop software.

The specific technical flaw involves incorrect permission assignments on a named pipe. According to the advisory, this misconfiguration allows a local attacker to leverage the service for privilege escalation. An attacker can execute arbitrary code in the context of the SYSTEM account by exploiting this path.

To successfully exploit this vulnerability, an attacker must first obtain the ability to execute low-privileged code on the target system. This prerequisite means the flaw cannot be triggered remotely without initial access or a separate entry point. The ZDI rated the severity as high, assigning a CVSS score of 7.8 to the defect.

Why it matters

Privilege escalation flaws in remote management tools are particularly dangerous because they can turn limited access into full system control. If an attacker gains initial foothold through phishing or another vector, this flaw provides a direct path to SYSTEM privileges.

NoMachine is widely used for remote desktop and server management across various operating systems. A compromise of the SYSTEM account allows an attacker to read or modify any file, install malicious software, or create new administrator accounts. This effectively neutralizes local security controls and user isolation mechanisms.

The fact that the flaw exists in the Device Service suggests it may be active during normal operation of the remote connection features. This increases the attack surface for any environment where NoMachine is installed and running as a background service. Timely patching is therefore critical to prevent lateral movement or persistence within the network.

What to watch

• Monitor vendor release notes for any follow-up advisories related to CVE-2026-111184 or the NoMachine Device Service.
• Check system logs for unusual privilege escalation events or unexpected code execution in the SYSTEM context.
• Verify that all endpoints have successfully installed the latest patches for versions 8, 9 and 10.
• Review access controls to ensure only authorized users can execute code on systems running NoMachine.

Who needs to act first

Teams should prioritize updating systems that are exposed to internal networks or have multiple user accounts. Check whether any servers or workstations are running versions 8, 9 or 10 without the latest patches. Roll out updates to critical infrastructure first, ensuring backups are current before applying changes. Test the patches in a non-production environment to verify compatibility with existing workflows. Reduce exposure by restricting local login rights where possible until all systems are verified as patched.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: NoMachine

• Inventory all systems running NoMachine to identify those on versions 8, 9 or 10 that lack the fix.
• Apply the vendor-provided updates for the respective versions to resolve the named pipe permission flaw.
• Restrict local code execution rights on endpoints to raise the barrier for initial exploitation attempts.
• Monitor system logs for signs of unauthorized privilege escalation or activity from the SYSTEM account.

Step-by-step guide: Spot Privilege Escalation Warning Signs Before Breach

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which CVE ID is associated with this NoMachine vulnerability?

The vulnerability is tracked as CVE-2026-111184.

What is the CVSS score for this flaw?

Zero Day Initiative assigned a CVSS rating of 7.8.

Is a fix available for this vulnerability?

Yes, patches are available for NoMachine versions 8, 9 and 10.