CVE-2026-92209 in NoMachine
Summary
by MITRE • 10/22/2026
NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the authentication mechanism controlling access to the Redis database. The issue results from using insufficient entropy in the generation of credentials. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-30984.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The identified security flaw resides within the authentication subsystem of NoMachine, specifically concerning its integration with a Redis database instance. This vulnerability represents a critical failure in credential generation practices that directly undermines the integrity of access controls for local privilege escalation. The core technical deficiency lies in the algorithmic process used to create or validate credentials required to interact with the underlying Redis service. Instead of employing cryptographically secure random number generators that utilize high-entropy sources, the implementation relies on a method producing insufficient entropy. This mathematical weakness means that the resulting credential values are not sufficiently unique or unpredictable, creating a statistical bias that can be exploited by an adversary who has already achieved low-level access to the system.
From a technical perspective, this flaw aligns with CWE-330, which classifies improper use of RNG in security contexts, and more specifically CWE-798 regarding the use of hardcoded or weak credentials. The operational impact is severe because it allows an attacker who has already executed code under a low-privileged user account to bypass authentication mechanisms protecting the Redis database. By predicting or brute-forcing the insufficiently random credential values, the adversary can gain unauthorized access to the service account associated with NoMachine and its backend data store. This effectively neutralizes the isolation boundaries intended by the operating system's permission model, allowing lateral movement within the local environment without requiring elevated privileges initially.
The exploitation of this vulnerability facilitates a direct path for privilege escalation as defined in MITRE ATT&CK technique T1068, which covers Exploitation for Privilege Escalation. Once an attacker gains control over the Redis instance through weak authentication, they can manipulate data stored within the database or potentially leverage known vulnerabilities in Redis itself to execute arbitrary commands on the host system with the privileges of the service account. This scenario is particularly dangerous because NoMachine often runs as a privileged service to manage remote desktop sessions and hardware acceleration features. Compromising this service grants the attacker significant control over the target machine, including the ability to install persistent backdoors, exfiltrate sensitive data from user sessions, or pivot further into connected networks if network access policies are permissive.
Mitigation strategies must focus on addressing both the immediate technical flaw and broader security hygiene practices. The primary remediation involves updating NoMachine to a version where the authentication mechanism has been patched to utilize cryptographically secure random number generators with high entropy for credential generation. Until such an update is applied, administrators should enforce strict file system permissions on Redis configuration files and socket paths to limit access only to authorized users. Additionally, implementing network segmentation can reduce the attack surface by ensuring that Redis instances are not exposed unnecessarily, although this vulnerability specifically targets local exploitation so network controls alone are insufficient. Security teams should also monitor for unusual authentication attempts or process executions originating from low-privileged accounts attempting to interact with NoMachine services as a detection mechanism for ongoing exploitation activities.