Critical Remote Code Execution (CVE‑2026‑18264) in NoMachine’s getstat Service Threatens Enterprise Remote Access
What It Is — NoMachine’s web service (listening on TCP 4000 by default) fails to validate a user‑supplied string before invoking a system call, allowing an authenticated attacker to inject commands and execute arbitrary code in the context of the service account.
Exploitability — CVSS 8.8 (High). Exploitable with valid credentials; proof‑of‑concept disclosed; vendor has issued a patch.
Affected Products — All NoMachine client/server installations that expose the getstat endpoint.
Why It Matters for Compliance & Audit Readiness
- Exposes a control‑gap that conflicts with SOC 2 access‑control criteria (CC6.1, CC6.2) requiring strict input validation and privileged‑access safeguards.
- Underscores the need for continuous vendor‑risk monitoring and documented patch‑management as audit evidence.
- Provides a concrete example for control‑mapping exercises, enabling organizations to capture remediation steps in a Trust Center‑ready audit trail.
Recommended Actions
- Apply NoMachine’s security update (KB TR06X11869) immediately.
- Restrict or disable port 4000 if the service is not required.
- Amend SOC 2 access‑control policies to enforce input validation for third‑party services.
- Log patch deployment and configuration changes in your compliance evidence repository.
Source: Zero Day Initiative Advisory