ZDI discloses two NoMachine local privilege escalation flaws
First coverage.
ZDI published two CVSS 7.8 NoMachine local privilege escalation bugs, CVE-2026-111184 and CVE-2026-111185.
The Zero Day Initiative published two NoMachine local privilege escalation advisories on 2026-10-15. ZDI-26-773 covers an incorrect permission assignment on a named pipe and is tracked as CVE-2026-111184 with a CVSS score of 7.8. ZDI-26-774 covers an uncontrolled search path element and is tracked as CVE-2026-111185, also scored CVSS 7.8. In both cases, a local attacker who can already run low-privileged code can escalate privileges on affected installations. Neither advisory states that exploitation has been observed.
- The Zero Day Initiative published ZDI-26-773 and ZDI-26-774 on 2026-10-15.
- ZDI-26-773 is an incorrect permission assignment on a NoMachine named pipe, tracked as CVE-2026-111184 with CVSS 7.8.
- ZDI-26-774 is an uncontrolled search path element in NoMachine, tracked as CVE-2026-111185 with CVSS 7.8.
- Both flaws allow local privilege escalation by an attacker who can already execute low-privileged code.
- Neither advisory states that exploitation has been observed or describes in-the-wild use.
Coverage
oldest first · one row per article · UTC- · 27d ago
ZDI Published AdvisoriesFirst report
ZDI-26-773: NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation Vulnerability
ZDI disclosed a CVSS 7.8 named-pipe permission flaw in NoMachine that allows local privilege escalation.
- · 27d ago
ZDI-26-774: NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
ZDI disclosed a CVSS 7.8 uncontrolled search path flaw in NoMachine enabling local privilege escalation.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111184 | Named pipe permission flaw enables local SYSTEM escalation in NoMachine | 7.8 | — | ||
| CVE-2026-111185 | — | — | — |