{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "NoMachine web player heap overflow lets unauthenticated attackers run code (CVE-2026-114549) · updates",
  "home_page_url": "https://pwn.watch/i/nomachine-nxwebrunner-cve-2026-114549",
  "feed_url": "https://pwn.watch/i/nomachine-nxwebrunner-cve-2026-114549/feed.json",
  "description": "Zero Day Initiative and NoMachine disclosed CVE-2026-114549, a pre-authentication heap buffer overflow in NoMachine's nxwebrunner web service (default TCP 4443). Unauthenticated remote attackers can execute code as the service account (CVSS 3.0 9.8). NoMachine's trouble report says the bug is fixed in 10.1.7, 9.9.6 and 8.27.1 (solved versions published Oct 27 2026); the CVE record was published around Nov 3–4 2026. Affected lines include 8.27 before 8.27.1, 9.9 before 9.9.6 and 10.1 before 10.1.7. Upgrade immediately; until then restrict or disable access to the web player port. No public exploit or CISA KEV listing was reported at publication.",
  "language": "en",
  "_pwn": {
    "slug": "nomachine-nxwebrunner-cve-2026-114549",
    "severity": "critical",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/nomachine-nxwebrunner-cve-2026-114549/feed.xml",
    "llms": "https://pwn.watch/i/nomachine-nxwebrunner-cve-2026-114549/llms.txt",
    "json": "https://pwn.watch/i/nomachine-nxwebrunner-cve-2026-114549.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/nomachine-nxwebrunner-cve-2026-114549#2026-11-03-64b53187",
      "url": "https://pwn.watch/i/nomachine-nxwebrunner-cve-2026-114549#2026-11-03-64b53187",
      "title": "NoMachine web player heap overflow lets unauthenticated attackers run code (CVE-2026-114549): CVE-2026-114549 is published (ZDI-CAN-30685): unauthenticated heap overflow RCE on the web service listening on TCP 4443 by default.",
      "content_text": "NoMachine web player heap overflow lets unauthenticated attackers run code (CVE-2026-114549): CVE-2026-114549 is published (ZDI-CAN-30685): unauthenticated heap overflow RCE on the web service listening on TCP 4443 by default.\n\nSource: https://nvd.nist.gov/vuln/detail/CVE-2026-114549",
      "date_published": "2026-11-03T00:00:00.000Z",
      "external_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114549",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/nomachine-nxwebrunner-cve-2026-114549#2026-10-27-b11cc399",
      "url": "https://pwn.watch/i/nomachine-nxwebrunner-cve-2026-114549#2026-10-27-b11cc399",
      "title": "NoMachine web player heap overflow lets unauthenticated attackers run code (CVE-2026-114549): NoMachine marks TR07X11893 solved in 10.1.7, 9.9.6 and 8.27.1 for a pre-auth heap overflow in nxwebrunner that may execute malicious code.",
      "content_text": "NoMachine web player heap overflow lets unauthenticated attackers run code (CVE-2026-114549): NoMachine marks TR07X11893 solved in 10.1.7, 9.9.6 and 8.27.1 for a pre-auth heap overflow in nxwebrunner that may execute malicious code.\n\nSource: https://kb.nomachine.com/TR07X11893",
      "date_published": "2026-10-27T00:00:00.000Z",
      "external_url": "https://kb.nomachine.com/TR07X11893",
      "tags": [
        "critical"
      ]
    }
  ]
}