Executive brief
NoMachine is a remote desktop and application access software used by enterprises to enable secure remote work. This vulnerability allows authenticated users to inject arbitrary commands into the getstat service component, enabling remote code execution with the privileges of the NoMachine service account. Attackers who gain user access can execute malicious code on servers running affected versions.
Technical details
This is a command injection vulnerability in NoMachine's web service (listening on TCP port 4000) that stems from insufficient input validation of user-supplied strings before passing them to system calls. The vulnerability requires prior authentication to exploit, and operates via the getstat command handler. An attacker with valid credentials can craft a malicious input string containing shell metacharacters to break out of the intended command context and execute arbitrary system commands in the context of the service account. The vulnerability affects NoMachine v8 and v9, and has been patched in versions 8.26.1 and 9.8.2. No evidence of active exploitation in the wild has been reported.
Affected products
- NoMachine NoMachine Server 8.x, 9.x (prior to 8.26.1 and 9.8.2)
Timeline
- 2026-07-24: disclosed: Vulnerability reported to vendor
- 2026-07-29: patched: Fix released in NoMachine 9.8.2 and 8.26.1
- 2026-07-29: advisory: ZDI-26-483 and CVE-2026-18264 coordinated public disclosure