ZDI-26-774: NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
ZDI disclosed a CVSS 7.8 uncontrolled search path flaw in NoMachine enabling local privilege escalation.
The Zero Day Initiative published ZDI-26-774, an uncontrolled search path element vulnerability in NoMachine. A local attacker who can already run low-privileged code can escalate privileges on affected installations. ZDI assigned CVSS 7.8 and CVE-2026-111185. No in-the-wild exploitation is described.
- Uncontrolled search path element in NoMachine
- Local attackers can escalate privileges
- Low-privileged code execution is a prerequisite
- CVSS 7.8; tracked as CVE-2026-111185
- CVEs
- CVE-2026-111185
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111185 | — | — | — |
From the original article
This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.