High severity · published Jun 10, 2026
CVE-2026-53694
Potential local privileges escalation through argument injection in the nxchmod.sh script
7.3
CVSS
0.1%
EPSS
No
On KEV
Description
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Nomachine allows Argument Injection.This issue affects Nomachine: before 9.5.7, before 8.23.2.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NO
NoMachine · NoMachine
7.0.0 before 9.5.7; 7.0.0 before 8.23.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-53694
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-53694
kb.nomachine.com
https://kb.nomachine.com/SU05X00274
kb.nomachine.com
https://kb.nomachine.com/SU05X00275
More from NoMachine
9.8
CVE-2018-0664
A vulnerability in NoMachine App for Android 5.0.63 and earlier allows attackers to alter environment variables via unspecified vectors
9.1
CVE-2023-39107
An arbitrary file overwrite vulnerability in NoMachine Free Edition and Enterprise Client for macOS before v8.8.1 allows attackers to overwrite root-owned files by using hardlinks
8.8
CVE-2026-92208
NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability
8.8
CVE-2026-18264
NoMachine getstat Command Injection Remote Code Execution Vulnerability
8.8
CVE-2017-12763
An unspecified server utility in NoMachine before 5.3.10 on Mac OS X and Linux allows authenticated users to gain privileges by gaining access to local files