Critical Local Privilege Escalation in NoMachine (CVE‑2026‑5054) Enables Root Access

Critical Local Privilege Escalation in NoMachine (CVE‑2026‑5054) Enables Root Access

What It Is – NoMachine’s remote‑desktop client contains an unchecked command‑line path parameter. A local attacker who can run code with low privileges can manipulate this parameter to write to arbitrary locations and trigger a privilege‑escalation chain that grants full root control.

Exploitability – The flaw is locally exploitable; an attacker must already have a foothold on the system. No public exploit code has been released, but the vulnerability is rated CVSS 7.8 (High) and is fixed in version 9.4.14.

Affected Products – NoMachine client for all platforms (versions prior to 9.4.14).

TPRM Impact –

• Remote‑access gateways that rely on NoMachine become a conduit for lateral movement into a supplier’s network.
• Compromise of a single endpoint can give attackers root on the host, potentially exposing data of downstream customers or partners.

Recommended Actions –

1. Inventory all third‑party assets that run NoMachine and verify the installed version.
2. Immediately upgrade to NoMachine 9.4.14 or later; apply the vendor’s patch.
3. If upgrade is not feasible, restrict execution of low‑privileged code on affected hosts (e.g., enforce least‑privilege policies, application whitelisting).
4. Monitor for anomalous file‑path arguments in NoMachine logs and for unexpected privilege‑escalation activity.
5. Communicate the risk to affected business units and update third‑party risk registers.

Source: Zero Day Initiative Advisory ZDI‑26‑248