TI-2026-78900 Aliases CVE-2026-92210 GHSA-q2x4-8x2v-f9cr

Server-side request forgery in NoMachine nxhtd web service

LOW 38CWE-918Published 2026-10-21 · Updated 2026-10-30

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA.

Summary

NoMachine nxhtd, the web service of affected NoMachine installations, does not properly validate a URI before accessing resources, a server-side request forgery flaw (CWE-918). A remote attacker without authentication can make the service send arbitrary requests in the context of its service account, which discloses information. The service listens on UDP port 4443 by default.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service, which listens on UDP port 4443 by default. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to initiate requests in the context of the service account. Was ZDI-CAN-31619.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00327 25th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
NoMachine	NoMachine	nomachine_9.8.2_1_amd64.deb	—	No fix listed	CNA

NoMachine VendorNoMachine Affected nomachine_9.8.2_1_amd64.deb Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:nomachine:nomachine::::::::	—	—	NoMachine

cpe:2.3:a:nomachine:nomachine:*:*:*:*:*:*:*:* Versions — — ·NoMachine

Remediation

The sources list no fixed version for NoMachine.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Timeline

2026-10-21 Threatist record created from CVE-2026-92210
2026-10-21 Alias added: GHSA-q2x4-8x2v-f9cr
2026-10-23 Priority changed: MEDIUM → LOW
2026-10-30 CISA SSVC decision points changed

References

Other 1

ZDI-26-712

TI-2023-20294 An arbitrary file overwrite vulnerability in NoMachine Free Edition and Enterprise Client… CVSS 3.1CRITICAL 9.1
TI-2026-84863 Heap overflow in NoMachine web service allows remote code execution CVSS 3.0CRITICAL 9.8
TI-2018-00619 Improper input validation in NoMachine App for Android CVSS 3.0CRITICAL 9.8
TI-2017-09455 An unspecified server utility in NoMachine before 5.3.10 on Mac OS X and Linux allows… CVSS 3.0HIGH 8.8
TI-2026-15017 OS command injection in NoMachine CVSS 3.0HIGH 8.8
TI-2026-78898 Heap overflow in NoMachine mDNS parsing enables remote code execution CVSS 3.0HIGH 8.8

See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences