CVE-2026-111184 NoMachine CVE debrief

Who should care

Defenders and administrators of systems with NoMachine installed, especially those concerned with local privilege escalation risks, should assess exposure and apply patches or updates.

Why it matters

CVE-2026-111184 is a local privilege escalation vulnerability in NoMachine that allows attackers to execute arbitrary code as SYSTEM. Defenders should verify and patch affected installations, monitor for suspicious activity, and implement additional security controls.

• Verify and patch affected NoMachine installations to prevent local privilege escalation
• Monitor systems for suspicious activity related to named pipes and privilege escalation
• Implement additional security controls to limit local code execution and privilege escalation

Technical summary

The vulnerability exists in the NoMachine Device Service due to incorrect permissions on a named pipe. An attacker must first execute low-privileged code to exploit this issue. Successful exploitation allows arbitrary code execution in the context of SYSTEM. The issue results from incorrect permissions on a named pipe in the NoMachine Device Service. Defenders should prioritize verifying and patching affected NoMachine installations, especially in local privilege escalation risk contexts. The vulnerability can be mitigated by applying patches or updates provided by NoMachine.

Defensive priority

Defenders should prioritize verifying and patching affected NoMachine installations, especially in local privilege escalation risk contexts.

Recommended defensive actions

• Verify NoMachine installations for version 9.7.3 and assess exposure
• Apply patches or updates provided by NoMachine
• Monitor systems for suspicious activity related to named pipes and privilege escalation
• Implement additional security controls to limit local code execution and privilege escalation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE and NVD records provide details on the vulnerability. A research advisory from ZDI is also available. The vulnerability has been publicly disclosed, and defenders should verify the affected installations, assess exposure, and apply patches or updates provided by NoMachine. The source details are limited, and defenders should exercise caution when verifying and patching affected systems. NoMachine has provided patches for this vulnerability, and defenders should prioritize verifying and patching affected installations, as well,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.