poslední zpráva · zachyceno
SPOJENO PŘES CVE EPSS 0.02
NoMachine: Possible escalation of privileges by impersonating the nx user
Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 8.8, CVEs: CVE-2026-18264, Summary: The following problem has been reported by ZeroDayInitiative (ZDI-26-483). A logged user could exploit the nx user via some server handlers to gain privileges for executing arbitrary operations. This issue affected NoMachine v9 and v8. It is now fixed in v9.8.2
NoMachine FI US
CVE v události 1
| CVE | hodnocení | KEV | EPSS |
|---|---|---|---|
| CVE-2026-18264 | 8.8 3.0 · zdi | – | 0.02 |
Hodnocení z katalogů, všechna, se stupnicí CVSS a vydavatelem. Rozpad vektoru je na stránce CVE. Advisory v textu uvádí CVSS 8.8.
Jak se o tom psalo 2
-
· zachyceno · NCSC-FI FI nadpis události
NoMachine: Possible escalation of privileges by impersonating the nx user
Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 8.8, CVEs: CVE-2026-18264, Summary: The following problem has been reported by ZeroDayInitiative (ZDI-26-483). A logged user could exploit the nx user via some server handlers to gain privileges for executing arbitrary operations. This issue affected NoMachine v9 and v8. It is now fixed in v9.8.2
-
· Zero Day Initiative US
ZDI-26-483: NoMachine getstat Command Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-18264.