Arbitrary File Deletion in NoMachine (CVE‑2026‑5053) Threatens Remote Workstations
What It Is – A local‑privilege flaw in NoMachine’s handling of environment variables allows an attacker who can run low‑privileged code to delete arbitrary files, including system files, with root‑level impact.
Exploitability – CVSS 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H). No public exploit is known, but the required low‑privilege code execution is trivial on many managed endpoints, making exploitation realistic in targeted attacks.
Affected Products – All NoMachine remote‑desktop installations prior to version 9.4.14 (both client and server components).
TPRM Impact – Remote‑access solutions are common in MSPs, SaaS providers, and enterprise IT teams. An exploited file‑deletion flaw can corrupt critical configuration files, erase logs, or disrupt services, creating a supply‑chain risk for any third‑party that relies on NoMachine for remote management.
Recommended Actions –
- Deploy NoMachine 9.4.14 or later immediately.
- Verify that all endpoints running NoMachine are patched and that version numbers are reported to your asset inventory.
- Harden local execution environments: restrict user‑level code execution, enforce least‑privilege policies, and monitor for abnormal file‑system activity.
- Add detection rules for unexpected file deletions in EDR/SIEM platforms.
- Review contracts with vendors that mandate the use of NoMachine and confirm remediation timelines.