Quick answers
- Is CVE-2026-114549 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-114549 being exploited in the wild.
- How severe is CVE-2026-114549?
- Critical severity, with a CVSS score of 9.8, published 4 November 2026.
- Which products and versions are affected?
- NoMachine nxwebrunner.
- Is there a fix for CVE-2026-114549?
- Yes: fixed in nxwebrunner 10.1.7, 9.9.6, 8.27.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-114549 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-114549?
- Check whether you run Nomachine Nxwebrunner. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: nxwebrunner 10.1.7, 9.9.6, 8.27.1
Technical details
A heap-based buffer overflow exists in NoMachine's web service (default TCP 4443) due to improper validation of user-supplied data length before copying to a heap buffer. An unauthenticated remote attacker can send specially crafted data over the network to trigger the overflow and achieve code execution in the context of the service account. The vulnerability is network-accessible with no authentication or user interaction required.
Affected products
- NoMachine nxwebrunner
Timeline
- 2026-07-24: disclosed: Vulnerability reported to vendor
- 2026-10-22: patched: Fixed in v10.1.7, 9.9.6, 8.27.1
- 2026-10-22: advisory: Coordinated public release of advisory