CVE ID Assignment Request – NoMachine Vulnerability
Disclosure Status
disclosed
August 19, 2026
August 19, 2026
Description
Finding
It was reported to us by a researcher Vonmetz Tobias
Reproducibility
Potential local privileges escalation through argument injection in the nxchmod.sh script
Impact
This is potential local privileges, it impacts NoMachine users with our app installed on Linux machines. However it only affects some of the configurations.
Patches
It was patched in NoMachine in versions 9.5.7 and 8.23.2
Workarounds
We have not tested any workaround, however patches are already available
References
Release notices for NoMachine 9.5.7 (https://kb.nomachine.com/SU05X00274) Release notices for NoMachine 8.23.2 (https://kb.nomachine.com/SU05X00275)