# CVE-2026-92210: NoMachine nxhtd server-side request forgery information disclosure

Source: https://junglewise.ai/threats/cve-2026-92210-nomachine-nxhtd-server-side-request-forgery-information  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-92210 · Severity: high · CVSS 7.2 · Published 2026-10-21

NoMachine nxhtd is a remote access service component that listens on UDP port 4443. This vulnerability allows unauthenticated attackers to make arbitrary requests through the service, potentially exposing sensitive information or modifying data without needing to log in. An attacker can exploit this remotely over the network to access resources and information in the context of the service account.

Technologies: [Nomachine](https://junglewise.ai/threats/technologies/nomachine). Vendors: [Nomachine](https://junglewise.ai/threats/vendors/nomachine).

## Quick answers

**Is CVE-2026-92210 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92210 being exploited in the wild.

**How severe is CVE-2026-92210?** High severity, with a CVSS score of 7.2, published 21 October 2026.

**Which products and versions are affected?** Nomachine versions before 8.27.1, 9.9.6, and 10.1.7.

**Is there a fix for CVE-2026-92210?** Yes: fixed in NoMachine v8.27.1, v9.9.6, v10.1.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92210 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-92210?** Check whether you run Nomachine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in NoMachine v8.27.1, v9.9.6, v10.1.7

## Technical details

A server-side request forgery (SSRF) vulnerability exists in the nxhtd web service due to insufficient validation of URIs before accessing resources. The flaw is network-accessible without authentication (AV:N/PR:N/UI:N) and allows an attacker to initiate arbitrary requests in the service account context, leading to information disclosure and potential integrity impact.

## Affected products

- NoMachine NoMachine versions before 8.27.1, 9.9.6, and 10.1.7

## Timeline

- 2026-08-07: disclosed: Vulnerability reported to vendor
- 2026-09-16: advisory: Coordinated public release of advisory
- 2026-09-16: patched: Fixed in NoMachine v8.27.1, v9.9.6, v10.1.7

## References

- [https://www.zerodayinitiative.com/advisories/ZDI-26-712/](https://www.zerodayinitiative.com/advisories/ZDI-26-712/)

## Related threats

- [NoMachine Redis improper authentication privilege escalation](https://junglewise.ai/threats/cve-2026-92209-nomachine-redis-improper-authentication-local-privilege)
- [NoMachine mDNS heap-based buffer overflow remote code execution](https://junglewise.ai/threats/cve-2026-92208-nomachine-mdns-heap-based-buffer-overflow-remote-code-execution)
- [NoMachine Device Service named pipe privilege escalation](https://junglewise.ai/threats/cve-2026-111184-nomachine-named-pipe-incorrect-permission-assignment-local)
- [NoMachine privilege escalation via argument injection in nxchmod.sh](https://junglewise.ai/threats/cve-2026-53694-nomachine-privilege-escalation-via-argument-injection-in-nxchmod)
- [NoMachine privilege escalation in Device Server](https://junglewise.ai/threats/cve-2026-5055-nomachine-privilege-escalation-in-device-server)