# CVE-2026-18264: NoMachine getstat command injection remote code execution

Source: https://junglewise.ai/threats/cve-2026-18264-nomachine-getstat-command-injection-remote-code-execution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-18264 · Severity: high · CVSS 8.8 · Published 2026-08-20

NoMachine is a remote desktop and application access software used by enterprises to enable secure remote work. This vulnerability allows authenticated users to inject arbitrary commands into the getstat service component, enabling remote code execution with the privileges of the NoMachine service account. Attackers who gain user access can execute malicious code on servers running affected versions.

Vendors: [Nomachine](https://junglewise.ai/threats/vendors/nomachine).

## Quick answers

**Is CVE-2026-18264 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18264 being exploited in the wild.

**How severe is CVE-2026-18264?** High severity, with a CVSS score of 8.8, published 20 August 2026.

**Which products and versions are affected?** NoMachine Server 8.x, 9.x (prior to 8.26.1 and 9.8.2).

**Is there a fix for CVE-2026-18264?** A patch was published on 2026-07-29: Fix released in NoMachine 9.8.2 and 8.26.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-18264 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-18264?** Check whether you run NoMachine Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a command injection vulnerability in NoMachine's web service (listening on TCP port 4000) that stems from insufficient input validation of user-supplied strings before passing them to system calls. The vulnerability requires prior authentication to exploit, and operates via the getstat command handler. An attacker with valid credentials can craft a malicious input string containing shell metacharacters to break out of the intended command context and execute arbitrary system commands in the context of the service account. The vulnerability affects NoMachine v8 and v9, and has been patched in versions 8.26.1 and 9.8.2. No evidence of active exploitation in the wild has been reported.

## Affected products

- NoMachine NoMachine Server 8.x, 9.x (prior to 8.26.1 and 9.8.2)

## Timeline

- 2026-07-24: disclosed: Vulnerability reported to vendor
- 2026-07-29: patched: Fix released in NoMachine 9.8.2 and 8.26.1
- 2026-07-29: advisory: ZDI-26-483 and CVE-2026-18264 coordinated public disclosure

## References

- [https://kb.nomachine.com/TR06X11869](https://kb.nomachine.com/TR06X11869)
- [https://www.zerodayinitiative.com/advisories/ZDI-26-483/](https://www.zerodayinitiative.com/advisories/ZDI-26-483/)