Local Privilege Escalation in NoMachine (CVE‑2026‑5055) Enables SYSTEM‑Level Code Execution
What It Is – NoMachine’s Device Server loads a library from an insecure, user‑writable location. An attacker who can run low‑privileged code on a host can replace that library, causing the service to load malicious code and gain SYSTEM privileges.
Exploitability – The flaw is local‑only; an attacker must already have a foothold. No public exploit code has been released, but the vulnerability is trivial to weaponize once code execution is achieved. CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates a high‑severity impact.
Affected Products – NoMachine Device Server (all versions prior to 9.4.14). Vendor: NoMachine.
TPRM Impact – Remote‑desktop tools are frequently embedded in third‑party SaaS platforms, managed service environments, and enterprise VPN solutions. A compromised NoMachine client can become a pivot point to elevate privileges on a supplier’s infrastructure, exposing downstream customers to data breach or service disruption risk.
Recommended Actions –
- Verify that all NoMachine installations are upgraded to version 9.4.14 or later.
- Conduct an inventory of NoMachine endpoints across your supply chain and confirm patch status.
- Restrict write permissions on directories used for library loading; enforce least‑privilege file system ACLs.
- Deploy endpoint detection and response (EDR) rules to alert on unexpected library loads or process launches under the NoMachine service.
- Review third‑party risk contracts for clauses requiring timely remediation of critical vulnerabilities.