Critical Remote Code Execution in NoMachine mDNS (CVE‑2026‑92208) Allows Unauthenticated Network‑Adjacent Attack
What It Is – A heap‑based buffer overflow in NoMachine’s mDNS parsing logic (CVE‑2026‑92208) enables an attacker on the same local network to execute arbitrary code with the service‑account’s privileges. No authentication is required.
Exploitability – The flaw is publicly disclosed, has a CVSS 8.8 (High) score, and a proof‑of‑concept exists in the advisory. No known active exploits in the wild yet, but the attack surface is trivial for any device that can reach the mDNS port.
Affected Products – NoMachine remote‑desktop client/server across all supported versions prior to v10.1.7, v9.9.6, and v8.27.1.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous patch management as a control evidence point for frameworks such as NIST CSF 2.0.
- Highlights gaps in asset inventory and configuration baselines that auditors will probe for defensible evidence.
- Provides a concrete example of why real‑time vulnerability monitoring is essential to maintain a trustworthy security posture for enterprise buyers.
Recommended Actions
- Verify your NoMachine version and upgrade immediately to v10.1.7, v9.9.6, or v8.27.1.
- Update your asset inventory to flag all NoMachine instances and map the remediation to the “Vulnerability Management” control area.
- Enable logging of mDNS traffic and monitor for anomalous queries or crashes.
- Capture patch‑deployment evidence for audit readiness.