NoMachine getstat Command Injection Opens Door to RCE, CVSS 8.8

ZDI-26-483 details a command injection flaw in NoMachine's getstat function that allows authenticated remote code execution. A patch is available, but the advisory omits affected versions and specific exploit details.

On July 29, 2026, Trend Micro published advisory ZDI-26-483 detailing a command injection vulnerability in the NoMachine web service. The flaw, tracked as CVE-2026-18264 with a CVSS score of 8.8, enables remote arbitrary code execution via the getstat function after authentication. The disclosure was coordinated with the vendor on July 24: a five-day window between report and public disclosure that left no margin for advance communication on exposed targets.

Key Takeaways

Vulnerability ZDI-26-483 (CVE-2026-18264, CVSS 8.8) resides in the getstat function of the NoMachine web service, which listens on TCP port 4000 by default
Authentication is a prerequisite for exploitation, but execution occurs in the service account context with high impact
NoMachine has released a corrective update, but the advisory does not list specific affected versions
The window between vendor notification (July 24) and coordinated publication (July 29) was five days

The Mechanism: From User Input to Unvalidated System Call

The flaw resides in the NoMachine web service, the component that manages the administration and monitoring interface of the remote access application. According to the ZDI advisory, the service listens on TCP port 4000 in its default configuration.

The specific defect concerns the getstat function, where a user-supplied string is passed directly to a system call without adequate validation. This lack of sanitization allows the injection of arbitrary commands in the service's execution context.

"This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is required to exploit this vulnerability." — Advisory ZDI-26-483

Execution occurs in the context of the service account, not necessarily with system administrator privileges, but with sufficient access to compromise the integrity of the NoMachine installation and potentially move laterally within the network. The CVSS 8.8 rating classifies the vulnerability as high severity, a value reflecting both the reduced attack complexity post-authentication and the impact on system confidentiality, integrity, and availability.

Authentication Required: A Real Barrier, Not an Absolute One

The advisory explicitly states that authentication is a prerequisite for exploiting the vulnerability. This technically raises the attack threshold compared to a fully anonymous RCE, but does not lower the risk to a negligible level.

NoMachine is commonly deployed in environments where access credentials are shared among operators, stored in centralized password management systems, or managed with long rotation policies. In these contexts, the compromise of a single credential set — via phishing, keylogging, or reuse from other breaches — immediately expands the attack surface. The CVSS 8.8 is not calculated on ideal scenarios of perfect isolation, but on realistic enterprise deployment conditions.

Furthermore, TCP port 4000 is often exposed on perimeter firewalls in remote access configurations over the Internet: an attacker does not need pre-existing internal presence to reach the vulnerable service.

Why It Matters

The ZDI advisory does not specify the NoMachine versions affected by the vulnerability. This omission creates an operational friction point for organizations managing large-scale NoMachine deployments.

Without an indication of vulnerable and patched versions, administrators cannot quickly discriminate which endpoints require urgent intervention and which are already protected. The dossier documents neither the corrective build number nor the patch distribution methods. The source states only that "NoMachine has issued an update to correct this vulnerability" without enriching the data with release identifiers or verification instructions.

Equally undocumented is the exact attack vector: the advisory does not describe the HTTP parameter, the request format, or the encoding required to trigger the injection. This reticence is consistent with ZDI's coordinated disclosure practice, but leaves defenders without specific indicators of compromise for active log hunting.

The brief reports no evidence of in-the-wild exploitation nor attribution to known threat actors. The absence of this data does not equate to safety: the CVSS 8.8 and the post-authentication nature of the flaw make it attractive to actors who already possess compromised credentials or operate in contexts of legitimate access gone awry.

Context: NoMachine in the Remote Access Landscape

NoMachine occupies a specific niche in the remote access market, with a proprietary architecture implementing its own NX protocol on an open code history base. Its differentiation from solutions like RDP, VNC, or modern SaaS platforms lies in performance and integration with Linux/Unix environments, segments where it maintains established installations in academic institutions, research centers, and legacy industrial infrastructures.

This deployment profile influences risk perception. Organizations running NoMachine often do so on systems that do not follow aggressive patching cadences, for compatibility with scientific workloads or due to scheduled maintenance constraints. The five-day window between notification and disclosure did not allow a structured internal testing cycle for these environments.

The advisory does not mention the identity of the researcher who discovered and reported the vulnerability. ZDI typically operates on a bug bounty program with compensation proportional to severity: the CVSS 8.8 suggests a significant payout, but the dossier contains no figures nor references to the specific reward program.

What the Source Does Not Specify

The cited measure provides no guidance on additional security controls, temporary workarounds, or alternative mitigation configurations to the update. No documentation emerges on restricting access to port 4000, applicable network filters, or monitoring of anomalous events on the getstat function.

The brief also does not report whether the fix corrects input validation in the specific function, modifies the web service architecture, or introduces other behavioral changes relevant to users. The impact of the patch on custom configurations or third-party integrations with the NoMachine service remains unquantified.

For organizations lacking automated inventory of installed software versions, verifying the presence of the vulnerability requires manual intervention on each endpoint. The dossier offers no tools to accelerate this process.

Information is based on the cited advisory and current as of the time of publication.

Sources

Information is based on the cited source and current as of the time of publication.

Sources

Sources and references