# CVE-2026-53694: NoMachine privilege escalation via argument injection in nxchmod.sh

Source: https://junglewise.ai/threats/cve-2026-53694-nomachine-privilege-escalation-via-argument-injection-in-nxchmod  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-53694 · Severity: info · CVSS 7.3 · Published 2026-06-10

NoMachine, a remote desktop and remote access tool, contains a vulnerability that could allow a local user to gain elevated system privileges. By exploiting a flaw in how the software handles specific internal scripts, an attacker with limited access to a computer could potentially take full control of the system. This could lead to unauthorized access to sensitive data or the disruption of business operations on the affected machine.

Technologies: [Nomachine](https://junglewise.ai/threats/technologies/nomachine). Vendors: [Nomachine](https://junglewise.ai/threats/vendors/nomachine).

## Quick answers

**Is CVE-2026-53694 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53694 being exploited in the wild.

**How severe is CVE-2026-53694?** Informational severity, with a CVSS score of 7.3, published 10 June 2026.

**Which products and versions are affected?** Nomachine before 9.5.7, before 8.23.2.

**Is there a fix for CVE-2026-53694?** A patch was published on 2026-05-07: NoMachine versions 9.5.7 and 8.23.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-53694 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-53694?** Check whether you run Nomachine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An argument injection vulnerability exists in NoMachine due to improper neutralization of argument delimiters within the 'nxchmod.sh' script. A local attacker with low-level privileges can exploit this flaw by passing specially crafted arguments to the script, leading to execution of commands with elevated permissions (Privilege Escalation). The vulnerability is reachable locally and does not require user interaction, though it may depend on specific environmental preconditions. The issue is resolved in NoMachine versions 9.5.7 and 8.23.2.

## Affected products

- NoMachine NoMachine before 9.5.7, before 8.23.2

## Timeline

- 2026-05-07: patched: NoMachine versions 9.5.7 and 8.23.2 released
- 2026-06-10: disclosed: CVE-2026-53694 published

## References

- [https://kb.nomachine.com/SU05X00274](https://kb.nomachine.com/SU05X00274)
- [https://kb.nomachine.com/SU05X00275](https://kb.nomachine.com/SU05X00275)

## Related threats

- [NoMachine nxhtd server-side request forgery information disclosure](https://junglewise.ai/threats/cve-2026-92210-nomachine-nxhtd-server-side-request-forgery-information)
- [NoMachine Redis improper authentication privilege escalation](https://junglewise.ai/threats/cve-2026-92209-nomachine-redis-improper-authentication-local-privilege)
- [NoMachine mDNS heap-based buffer overflow remote code execution](https://junglewise.ai/threats/cve-2026-92208-nomachine-mdns-heap-based-buffer-overflow-remote-code-execution)
- [NoMachine Device Service named pipe privilege escalation](https://junglewise.ai/threats/cve-2026-111184-nomachine-named-pipe-incorrect-permission-assignment-local)
- [NoMachine privilege escalation in Device Server](https://junglewise.ai/threats/cve-2026-5055-nomachine-privilege-escalation-in-device-server)