Get DeafLetter
A weekly selection of signals, vulnerabilities and guides. Critical alerts remain optional.
You can unsubscribe at any time. Privacy policy.
On September 16, 2026, TrendAI published advisory ZDI-26-711 detailing a local privilege escalation vulnerability in NoMachine's Redis authentication mechanism. The flaw, discovered on July 29 and reported to the vendor under coordinated disclosure, exploits cryptographically insufficient entropy in the generation of internal database credentials: an attacker with local access and limited privileges can predict or derive those credentials, bypass authentication, and execute code in the context of the service account. The assigned CVE is 2026-92209, currently in reserved status.
- Insufficient entropy: NoMachine's internal Redis credential generation uses cryptographically inadequate entropy, making keys predictable or derivable
- Attack condition: the attacker must already have the ability to execute low-privileged code on the target system
- Documented impact: successful exploit allows arbitrary code execution in the context of the service account with local privilege escalation
- Patches available: NoMachine has released fixed versions 10.1.7, 9.9.6, and 8.27.1
The Mechanism: How "Invisible" Redis Becomes Attack Surface
NoMachine employs Redis as an internal infrastructure component, invisible to the end user interacting with the remote desktop client. The ZDI-26-711 discovery shifts focus precisely to this hidden layer: the authentication mechanism controlling access to the Redis database generates credentials with insufficient entropy. This weakness is not a systemic misconfiguration or a forgotten default password, but a design flaw in the generation process itself.
The advisory specifies that the attacker "must first obtain the ability to execute low-privileged code on the target system." The wording rules out remote exploitation and confines the risk to multi-user environments where unprivileged actors already possess a shell or local code execution. Once the Redis boundary is crossed, the vulnerability allows the attacker to "escalate privileges and execute arbitrary code in the context of the service account."
The Gap Between User Visibility and Internal Complexity
The most significant angle of this discovery lies in the perceptual distance between NoMachine's user interface and its underlying architecture. End users see a remote desktop tool; system administrators must instead track infrastructure dependencies like Redis, often absent from superficial security assessments. The vulnerability demonstrates that "invisible" components can become the pivot for attacks with high impact on privilege segregation.
The Redis database in question is not a network-exposed instance or one configured by the administrator: it is an embedded component, managed transparently by the product. This deployment model, common in enterprise software, transfers responsibility for internal cryptographic security to the vendor. When that responsibility fails, as in the case of reduced-entropy credential generation, the attack surface materializes at a point that standard hardening checklists rarely intercept.
"The specific flaw exists within the authentication mechanism controlling access to the Redis database. The issue results from using insufficient entropy in the generation of credentials." — ZDI Advisory ZDI-26-711
Timeline and Patch Availability
The window between discovery and patch is measurable: 49 days between the vendor report on July 29, 2026 and the coordinated release on September 16, 2026. NoMachine distributed fixes across three version branches: 10.1.7 for the main line, 9.9.6 for the previous series, and 8.27.1 for legacy installations. The dossier does not specify whether intermediate versions are affected or if other unmentioned branches exist.
CVE-2026-92209, assigned to the vulnerability, is currently in reserved status on cve.org: the record exists but does not yet contain populated technical details. This delay is not unusual for recent disclosures, but leaves a temporal gap in which standardized vulnerability tracking provides no additional information beyond the ZDI advisory.
Why It Matters
The brief does not document specific mitigations beyond version upgrade. The dossier does not specify the nature of data managed by the internal Redis, nor whether the compromised service account has access to file systems, network configurations, or other sensitive resources. The ZDI advisory does not report a CVSS score, attack vector, or researcher identity, suggesting a minimal-form publication: additional information may emerge from future updates.
The source does not specify whether exploits or PoC demonstrations have been published, nor whether the vulnerability has been actively exploited in-the-wild. The absence of these elements does not lower the risk profile for organizations using NoMachine in multi-user environments, but prevents quantifying the likelihood of attack.
Frequently Asked Questions
Is the vulnerability remotely exploitable?
No. The ZDI advisory explicitly states that the attacker must already have the ability to execute low-privileged code on the target system. This is a local privilege escalation, not a remote access vulnerability.
Can I verify if my installation is vulnerable without knowing the exact version?
The dossier does not provide indicators of compromise or alternative detection methods to version verification. NoMachine has released patches for the 10.x, 9.x, and 8.x branches: identifying the installed version remains the determining criterion.
Why doesn't the CVE contain details yet?
The CVE-2026-92209 record is in reserved status, a standard condition for identifiers assigned but not yet populated with technical description. The ZDI advisory remains the primary structured source available.
Information is based on the cited advisory and current as of publication.
Sources
Information is based on the cited source and current as of publication.
Sources
Get DeafLetter
A weekly selection of signals, vulnerabilities and guides. Critical alerts remain optional.
You can unsubscribe at any time. Privacy policy.