# CVE-2026-111184: NoMachine Device Service named pipe privilege escalation

Source: https://junglewise.ai/threats/cve-2026-111184-nomachine-named-pipe-incorrect-permission-assignment-local  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-111184 · Severity: high · CVSS 7.8 · Published 2026-10-21

NoMachine is remote access software that allows users to connect to and control computers remotely. This vulnerability enables a local attacker with limited privileges to gain complete system control by exploiting incorrect permission settings on a named pipe used by the NoMachine Device Service. An attacker must first be able to run code on the target system, but once they do, they can execute arbitrary commands with SYSTEM-level privileges, potentially compromising the entire computer.

Technologies: [Nomachine](https://junglewise.ai/threats/technologies/nomachine). Vendors: [Nomachine](https://junglewise.ai/threats/vendors/nomachine).

## Quick answers

**Is CVE-2026-111184 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111184 being exploited in the wild.

**How severe is CVE-2026-111184?** High severity, with a CVSS score of 7.8, published 21 October 2026.

**Which products and versions are affected?** Nomachine versions prior to v8, v9, and v10.

**Is there a fix for CVE-2026-111184?** Yes: fixed in v10, v9, v8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111184 attacked?** It is attacked with local access, in a hosted service.

**Am I affected by CVE-2026-111184?** Check whether you run Nomachine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in v10, v9, v8

## Technical details

The NoMachine Device Service creates a named pipe with overly permissive access controls (CWE-276), allowing a local attacker to interact with it without appropriate privilege restrictions. An attacker with local code execution capability can exploit this misconfiguration to escalate from low-privileged code to SYSTEM context. The attack requires local access and existing code execution capability but does not require user interaction or authentication bypass.

## Affected products

- NoMachine NoMachine versions prior to v8, v9, and v10

## Timeline

- 2026-08-07: disclosed: Vulnerability reported to vendor
- 2026-10-15: advisory: Coordinated public release of advisory
- 2026-10-21: other: Published to NVD

## References

- [https://www.zerodayinitiative.com/advisories/ZDI-26-773/](https://www.zerodayinitiative.com/advisories/ZDI-26-773/)

## Related threats

- [NoMachine nxhtd server-side request forgery information disclosure](https://junglewise.ai/threats/cve-2026-92210-nomachine-nxhtd-server-side-request-forgery-information)
- [NoMachine Redis improper authentication privilege escalation](https://junglewise.ai/threats/cve-2026-92209-nomachine-redis-improper-authentication-local-privilege)
- [NoMachine mDNS heap-based buffer overflow remote code execution](https://junglewise.ai/threats/cve-2026-92208-nomachine-mdns-heap-based-buffer-overflow-remote-code-execution)
- [NoMachine privilege escalation via argument injection in nxchmod.sh](https://junglewise.ai/threats/cve-2026-53694-nomachine-privilege-escalation-via-argument-injection-in-nxchmod)
- [NoMachine privilege escalation in Device Server](https://junglewise.ai/threats/cve-2026-5055-nomachine-privilege-escalation-in-device-server)