CVE‑2026‑92210: NoMachine nxhtd Server‑Side Request Forgery Allows Unauthenticated Information Disclosure
What It Is – A server‑side request forgery (SSRF) flaw in the NoMachine nxhtd web service (UDP 4443) lets an unauthenticated attacker force the service to issue arbitrary HTTP/HTTPS requests and read the responses. The vulnerability stems from missing URI validation before the service‑account‑bound request is made.
Exploitability – No authentication or user interaction required; proof‑of‑concept code is publicly available. CVSS v3.1 base score 7.2 (High).
Affected Products – NoMachine remote‑desktop clients/servers (all versions prior to v10.1.7, v9.9.6, v8.27.1).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous validation of service‑level controls; a missing input‑validation check can break the audit trail and expose internal resources.
- Highlights the importance of maintaining up‑to‑date evidence that configuration controls (e.g., firewall rules, service hardening) are enforced, a key signal for enterprise buyers demanding defensible trust.
- Provides a concrete test of the “secure configuration and input‑validation” control objective that maps to multiple frameworks (e.g., NIST CSF 2.0 Identify → Asset Management, Protect → Data Security).
Recommended Actions
- Deploy the NoMachine patches (v10.1.7, v9.9.6, v8.27.1) immediately.
- Restrict UDP 4443 at the network perimeter or disable the service if not required.
- Conduct a focused input‑validation test on all web‑exposed services and record the results in your control‑mapping repository.
- Update your continuous‑monitoring evidence set to show remediation and ongoing compliance.