SEPTEMBER 19, 2026
Live Feed
Back to database
Case File

CVE-2026-18264

HIGH · CVSS 8.8 EPSS 1.24% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-20 · Last synced 2026-09-18

CyberRota Analysis

AI-Generated

A command injection vulnerability in the NoMachine web service allows authenticated remote attackers to execute arbitrary code on affected installations, potentially compromising the service account. This flaw arises from insufficient validation of user-supplied input before it is used in system calls. Organizations using NoMachine should prioritize patching this vulnerability to mitigate the risk of unauthorized code execution.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
exploit remote code execution code execution

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-18264
Severity
HIGH
CVSS
8.8
EPSS
1.24%

Original NVD Description

NoMachine getstat Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 4000 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. . Was ZDI-CAN-30634.