Nomachine vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-92210 NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability.High 7.2 · Oct 21, 2026
• CVE-2026-92209 NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability.High 7.8 · Oct 21, 2026
• CVE-2026-92208 NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability.High 8.8 · Oct 21, 2026
• CVE-2026-111184 NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation Vulnerability.High 7.8 · Oct 21, 2026
• CVE-2026-18264 NoMachine getstat Command Injection Remote Code Execution Vulnerability.High 8.8 · Aug 20, 2026
• CVE-2026-53694 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Nomachine allows Argument Injection.This issue affects NomacHigh 7.3 · Jun 10, 2026
• CVE-2026-5055 NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability.High 7.8 · Apr 10, 2026
• CVE-2026-5054 NoMachine External Control of File Path Local Privilege Escalation Vulnerability.High 7.8 · Apr 10, 2026
• CVE-2026-5053 NoMachine External Control of File Path Arbitrary File Deletion Vulnerability.High 7.1 · Apr 10, 2026
• CVE-2025-8614 NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability.High 7.8 · Sep 2, 2025
• CVE-2024-7253 NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability.High 7.8 · Nov 22, 2024
• CVE-2023-39107 An arbitrary file overwrite vulnerability in NoMachine Free Edition and Enterprise Client for macOS before v8.8.1 allows attackers to overwrite root-owned filesCritical 9.1 · Aug 4, 2023
• CVE-2022-34043 Incorrect permissions for the folder C:\ProgramData\NoMachine\var\uninstall of Nomachine v7.9.2 allows attackers to perform a DLL hijacking attack and execute aHigh 7.3 · Jun 29, 2022
• CVE-2021-33436 NoMachine for Windows prior to version 6.15.1 and 7.5.2 suffer from local privilege escalation due to the lack of safe DLL loading.High 7.3 · Apr 28, 2022
• CVE-2021-42986 NoMachine Enterprise Client is affected by Integer Overflow.High 8.8 · Dec 7, 2021
• CVE-2021-42983 NoMachine Enterprise Client is affected by Buffer Overflow.High 8.8 · Dec 7, 2021
• CVE-2021-42980 NoMachine Cloud Server is affected by Buffer Overflow.High 8.8 · Dec 7, 2021
• CVE-2021-42979 NoMachine Cloud Server is affected by Integer Overflow.High 8.8 · Dec 7, 2021
• CVE-2021-42977 NoMachine Enterprise Desktop is affected by Integer Overflow.High 8.8 · Dec 7, 2021
• CVE-2021-42976 NoMachine Enterprise Desktop is affected by Buffer Overflow.High 8.8 · Dec 7, 2021
• CVE-2021-42973 NoMachine Server is affected by Integer Overflow.High 8.8 · Dec 7, 2021
• CVE-2021-42972 NoMachine Server is affected by Buffer Overflow.High 8.8 · Dec 7, 2021
• CVE-2018-17980 NoMachine before 5.3.27 and 6.x before 6.3.6 allows attackers to gain privileges via a Trojan horse wintab32.dll file located in the same directory as a .nxs fiHigh 7.8 · Oct 15, 2018
• CVE-2018-6947 An uninitialised stack variable in the nxfuse component that is part of the Open Source DokanFS library shipped with NoMachine 6.0.66_2 and earlier allows a locHigh 7.8 · Feb 28, 2018
• CVE-2017-12763 An unspecified server utility in NoMachine before 5.3.10 on Mac OS X and Linux allows authenticated users to gain privileges by gaining access to local files.High 8.8 · Aug 29, 2017