ZDI-26-773: NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation Vulnerability
ZDI disclosed a CVSS 7.8 named-pipe permission flaw in NoMachine that allows local privilege escalation.
The Zero Day Initiative published ZDI-26-773, an incorrect permission assignment on a NoMachine named pipe. Local attackers who can already execute low-privileged code can escalate privileges. ZDI assigned CVSS 7.8 and CVE-2026-111184. The advisory does not state that exploitation has been observed.
- Named pipe has incorrect permission assignment
- Local privilege escalation on NoMachine
- Requires existing low-privileged code execution
- CVSS 7.8; tracked as CVE-2026-111184
- CVEs
- CVE-2026-111184
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111184 | Named pipe permission flaw enables local SYSTEM escalation in NoMachine | 7.8 | — |
From the original article
This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.