CVE-2026-18264

Name of the Vulnerable Software and Affected Versions NoMachine (affected versions not specified)

Description Remote authenticated attackers can execute arbitrary code on the system via the web service, which typically listens on TCP port 4000. The issue occurs because the service fails to properly validate a user-supplied string before using it in a system call, specifically within the getstat command. This allows the attacker to execute code with the privileges of the service account.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.