CVE-2026-92210 NoMachine CVE debrief

Who should care

Defenders responsible for NoMachine installations, especially those exposed to untrusted networks, should assess their exposure and implement measures to prevent or mitigate SSRF attacks. Network administrators and security teams should prioritize verifying the security of NoMachine configurations and monitoring for potential exploitation attempts.

Why it matters

CVE-2026-92210 is a Server-Side Request Forgery (SSRF) vulnerability in NoMachine nxhtd that allows remote attackers to initiate arbitrary server-side requests without authentication. Defenders should prioritize verifying exposure, monitoring for exploitation attempts, and implementing compensating controls to limit the impact of potential SSRF attacks.

• Defenders need to verify NoMachine installations for exposure to untrusted networks.
• Security teams should monitor for unusual server-side requests that could indicate SSRF exploitation.
• Implementing compensating controls to limit the impact of potential SSRF attacks is crucial.
• Incident response plans should be reviewed and updated to address potential SSRF exploitation.

Technical summary

The vulnerability exists within the NoMachine nxhtd web service, which listens on UDP port 4443 by default. The issue results from the lack of proper validation of a URI prior to accessing resources, allowing remote attackers to initiate arbitrary server-side requests without authentication. This SSRF vulnerability can be leveraged to initiate requests in the context of the service account, potentially leading to information disclosure. Defenders should be aware of the potential impact on NoMachine installations, especially those exposed to untrusted networks.

Defensive priority

Defenders should prioritize verifying exposure of NoMachine installations to untrusted networks, especially if UDP port 4443 is exposed. They should also monitor for unusual server-side requests and implement compensating controls to limit the impact of potential SSRF exploitation.

Recommended defensive actions

• Verify NoMachine installations for exposure to untrusted networks, especially UDP port 4443.
• Monitor server-side requests for unusual patterns that could indicate SSRF exploitation.
• Implement compensating controls to limit the impact of potential SSRF attacks.
• Review and update incident response plans to address potential SSRF exploitation.
• Conduct a thorough asset inventory to identify all instances of NoMachine nxhtd.
• Establish a process for tracking and addressing exceptions during remediation.
• Schedule and verify vendor-supported updates or mitigations for exposed systems.

Evidence notes

The CVE record and source item provide details about the vulnerability, including its existence within the NoMachine nxhtd web service, the lack of authentication required for exploitation, and the potential for SSRF attacks. However, specific details about affected versions, patches, or exploitation are limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.