NoMachine: SSRF on UDP 4443 Exposes Enterprise Servers Without Authentication

On September 16, 2026, the Trend Micro Zero Day Initiative published advisory ZDI-26-712 for a vulnerability in the nxhtd service of NoMachine. The flaw enables unauthenticated SSRF attacks by exploiting a lack of URI validation on UDP port 4443, with a risk of arbitrary server-side requests in the context of the service account.

Verified Facts

Primary Source: The ZDI-26-712 advisory is the sole structured source with technical details on this vulnerability. The CVE-2026-92210 record is in reserved status and adds no operational information.

NoMachine is an enterprise remote-access platform. The nxhtd service is the web component that handles the application's HTTP/HTTPS traffic. Advisory ZDI-26-712 identifies the flaw specifically in this service.

The vulnerable service listens on UDP port 4443 by default. Enterprise firewall policies are typically built to filter and monitor TCP: stateful connections, three-way handshakes, traceable sessions. UDP is connectionless and often overlooked in network segmentation rules.

"This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of NoMachine. Authentication is not required to exploit this vulnerability." — ZDI Advisory ZDI-26-712

According to the ZDI advisory, the flaw stems from the failure to validate a URI before the service accesses the requested resources. In an SSRF attack, the attacker sends input that the application reinterprets as requests to attacker-chosen destinations.

The absence of authentication requirements removes any barrier to entry. The advisory specifies that the attacker can initiate requests in the context of the service account running nxhtd. The ZDI dossier does not specify which precise resources are accessible in this context.

Analysis: Why the UDP-SSRF Vector Is Unusual

Editor's note: this section contains inferences based on common enterprise security practices, not on data present in the brief.

The combination of UDP and SSRF is atypical for a remote-access product. In typical scenarios, enterprise infrastructure heavily monitors TCP traffic on known service ports. UDP traffic on dedicated ports such as 4443 may receive less attention in standard security controls.

The UDP protocol, being connectionless, presents characteristics that in some network configurations can complicate stateful logging and filtering. This does not imply that analysis tools are inadequate, but that the vector may require specific monitoring rules.

The choice of UDP for a web service like nxhtd is technically legitimate but unconventional. HTTP/3 uses QUIC over UDP, but nxhtd is a traditional HTTP/HTTPS service. Port 4443 is sometimes used as a non-standard HTTPS alternative, but the ZDI advisory explicitly confirms the UDP protocol.

Disclosure Timeline and Patches Released

The disclosure follows the coordinated model of the Trend Micro Zero Day Initiative. The vendor was notified on August 7, 2026; public release occurred on September 16, 2026. The interval of roughly 40 days aligns with NoMachine's development and testing cycles.

The versions that remediate the vulnerability are:

• NoMachine v10.1.7 (current release)
• NoMachine v9.9.6 (maintenance branch)
• NoMachine v8.27.1 (supported legacy branch)

The assigned CVE is CVE-2026-92210, currently in reserved status in the MITRE database. The CVE record is not yet populated with additional technical details.

The vendor published patches across three branches simultaneously. This pattern indicates the vulnerability affects code shared across the different release lines, not an isolated regression.

Immediate Actions

For administrators managing NoMachine infrastructure, the priority actions derive directly from the ZDI advisory:

• Verify the installed version and update to v10.1.7, v9.9.6, or v8.27.1 depending on the branch in use
• Review firewall rules for UDP traffic to port 4443: restrict access to authorized hosts only where possible
• Monitor nxhtd service logs for anomalous requests that may indicate SSRF attempts

Version verification is the mandatory first step. Enterprise environments with distributed deployments should use inventory tools to identify unpatched NoMachine instances.

UDP filtering on port 4443 must be explicit in security policies. Many firewall configurations treat UDP permissively by default; this vulnerability demands a dedicated rule.

Documented Limits and Uncertainties

The ZDI-26-712 advisory does not specify several elements relevant to risk assessment:

• No CVSS score or severity vector is available
• No evidence of in-the-wild exploitation is documented
• Intermediate versions are not explicitly covered by the advisory: it is presumed that all releases prior to the fixes are vulnerable, but the vendor has not published a complete matrix
• The service account context could permit access to internal resources, depending on system configuration; the advisory does not enumerate which resources are involved
• No technical payload details or proof-of-concept have been published

These limits are inherent to the coordinated disclosure phase and may be addressed by future vendor updates or the CVE record.

Closing

Vulnerability ZDI-26-712 represents a significant case of unauthenticated SSRF over UDP in a widely deployed enterprise product. The speed of the vendor's response — three release lines patched in roughly 40 days — signals operational priority. For organizations using NoMachine, timely updating remains the only documented mitigation.

The Trend Micro Zero Day Initiative continues to manage the coordinated disclosure. Any updates on CVSS scoring or in-the-wild exploitation will be published through official ZDI channels and in the CVE-2026-92210 record when populated.

Information has been verified against cited sources and is current as of publication.

Sources

• http://www.zerodayinitiative.com/advisories/ZDI-26-712/
• https://www.cve.org/CVERecord?id=CVE-2026-92210
• http://www.zerodayinitiative.com/advisories/upcoming/
• https://www.trendmicro.com/
• https://www.trendmicro.com/en_us/business/products/one-platform.html