Local Privilege Escalation in NoMachine Device Service (CVE‑2026‑111184) Scores 7.8
What It Is — A local privilege‑escalation flaw in the NoMachine Device Service caused by an incorrectly permissioned named‑pipe. An attacker who can run low‑privileged code can elevate to the SYSTEM account and execute arbitrary commands.
Exploitability — CVSS 7.8 (High). Exploits require only local code execution, have low complexity, and grant full confidentiality, integrity, and availability impact. No public exploit code is known, but the low barrier makes rapid patching essential.
Affected Products — NoMachine remote‑desktop client and server (all versions prior to the patched releases v10, v9, and v8).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous verification of service‑level permissions as part of a least‑privilege access‑control program.
- Provides audit‑ready evidence that privileged‑access configurations are being monitored and remediated— a key trust signal for enterprise buyers and regulators.
- Shows how a single misconfiguration can undermine broader security controls, underscoring the value of an integrated control‑mapping and evidence‑collection platform.
Recommended Actions
- Apply the vendor‑provided patches (v10, v9, v8) immediately.
- Review and harden the ACLs on the NoMachine named pipe; enforce least‑privilege defaults.
- Integrate permission‑state monitoring into your continuous control‑assurance tooling to generate defensible audit logs.
- Update incident‑response playbooks to include detection of unexpected SYSTEM‑level activity stemming from local privilege escalation.