NoMachine nxwebrunner heap overflow allows unauthenticated RCE
ZDI rates CVE-2026-114549 at CVSS 9.8; the snippet names no versions and no confirmed attacks.
72
Vendor
NoMachine
- Mentions · 7d0
- Mentions · 30d3
- All mentions6
- First seenSep 16, 2026
- Last mentioned20d ago
Timeline
6 articles · newest firstZDI-26-773: NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation Vulnerability
ZDI disclosed a CVSS 7.8 named-pipe permission flaw in NoMachine that allows local privilege escalation.
42
ZDI-26-774: NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
ZDI disclosed a CVSS 7.8 uncontrolled search path flaw in NoMachine enabling local privilege escalation.
42
ZDI-26-712: NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability
ZDI disclosed CVE-2026-92210, an unauthenticated server-side request forgery in NoMachine's nxhtd server leading to information disclosure (CVSS 7.2).
25
ZDI-26-710: NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability
ZDI disclosed CVE-2026-92208, an unauthenticated heap-based buffer overflow in NoMachine's mDNS service enabling network-adjacent remote code execution (CVSS 8.8).
40
ZDI-26-711: NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability
ZDI disclosed CVE-2026-92209, an improper authentication flaw in NoMachine's bundled Redis component allowing local privilege escalation (CVSS 7.8).
25
Related CVEs
by mentions- Heap-based Buffer Overflow RCE in NoMachine nxwebrunner
- Heap buffer overflow RCE in NoMachine mDNS parsing
- Named pipe permission flaw enables local SYSTEM escalation in NoMachine
- Local privilege escalation via NoMachine Redis authentication
- Unauthenticated SSRF in NoMachine nxhtd on UDP 4443
Appears with
- NoMachineproduct · 4
- Zero Day Initiativeorganization · 4
- Zero Day Initiativevendor · 3
- NoMachineorganization · 2
- NoMachine nxhtdproduct · 1
- nxwebrunnerproduct · 1
- Redisproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.