# NoMachine web player heap overflow lets unauthenticated attackers run code (CVE-2026-114549) · pwn.watch

> Zero Day Initiative and NoMachine disclosed CVE-2026-114549, a pre-authentication heap buffer overflow in NoMachine's nxwebrunner web service (default TCP 4443). Unauthenticated remote attackers can execute code as the service account (CVSS 3.0 9.8). NoMachine's trouble report says the bug is fixed in 10.1.7, 9.9.6 and 8.27.1 (solved versions published Oct 27 2026); the CVE record was published around Nov 3–4 2026. Affected lines include 8.27 before 8.27.1, 9.9 before 9.9.6 and 10.1 before 10.1.7. Upgrade immediately; until then restrict or disable access to the web player port. No public exploit or CISA KEV listing was reported at publication.

Page: https://pwn.watch/i/nomachine-nxwebrunner-cve-2026-114549 · generated 2026-11-04T14:30:54.317Z

## Status
- Severity: critical · status: live · patch: patched
- Product: NoMachine (nxwebrunner / Web Player)
- Started: 2026-10-27
- CVEs: CVE-2026-114549
- Affected: NoMachine 8.27 before 8.27.1; NoMachine 9.9 before 9.9.6; NoMachine 10.1 before 10.1.7
- Fixed in: 8.27.1; 9.9.6; 10.1.7

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/nomachine-nxwebrunner-cve-2026-114549/feed.xml
- JSON Feed: https://pwn.watch/i/nomachine-nxwebrunner-cve-2026-114549/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/nomachine-nxwebrunner-cve-2026-114549.json
- This file: https://pwn.watch/i/nomachine-nxwebrunner-cve-2026-114549/llms.txt

## Updates (newest first)
- 2026-11-03: CVE-2026-114549 is published (ZDI-CAN-30685): unauthenticated heap overflow RCE on the web service listening on TCP 4443 by default. (https://nvd.nist.gov/vuln/detail/CVE-2026-114549)
- 2026-10-27: NoMachine marks TR07X11893 solved in 10.1.7, 9.9.6 and 8.27.1 for a pre-auth heap overflow in nxwebrunner that may execute malicious code. (https://kb.nomachine.com/TR07X11893)

## Fix brief
# Security brief: NoMachine web player heap overflow lets unauthenticated attackers run code (CVE-2026-114549)

Source: https://pwn.watch/i/nomachine-nxwebrunner-cve-2026-114549 · status: live · severity: critical · updated Nov 4, 2026, 11:40 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
Zero Day Initiative and NoMachine disclosed CVE-2026-114549, a pre-authentication heap buffer overflow in NoMachine's nxwebrunner web service (default TCP 4443). Unauthenticated remote attackers can execute code as the service account (CVSS 3.0 9.8). NoMachine's trouble report says the bug is fixed in 10.1.7, 9.9.6 and 8.27.1 (solved versions published Oct 27 2026); the CVE record was published around Nov 3–4 2026. Affected lines include 8.27 before 8.27.1, 9.9 before 9.9.6 and 10.1 before 10.1.7. Upgrade immediately; until then restrict or disable access to the web player port. No public exploit or CISA KEV listing was reported at publication.

Severity detail: CVSS 9.8 unauthenticated RCE on the web service (TCP 4443); no known exploitation at CVE publication

- Product: NoMachine (nxwebrunner / Web Player)
- CVE / advisory ids: CVE-2026-114549

## Affected versions
- NoMachine 8.27 before 8.27.1
- NoMachine 9.9 before 9.9.6
- NoMachine 10.1 before 10.1.7

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- 8.27.1
- 9.9.6
- 10.1.7

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Specific notes
If you expose NoMachine Web Player, upgrade to 10.1.7, 9.9.6 or 8.27.1. Until patched, block TCP 4443 at the network edge or disable the web service.

## Latest updates
- Nov 3, 2026: CVE-2026-114549 is published (ZDI-CAN-30685): unauthenticated heap overflow RCE on the web service listening on TCP 4443 by default.
- Oct 27, 2026: NoMachine marks TR07X11893 solved in 10.1.7, 9.9.6 and 8.27.1 for a pre-auth heap overflow in nxwebrunner that may execute malicious code.

## Advisories
- [Possible heap buffer overflow in NoMachine web application (CVE-2026-114549)](https://kb.nomachine.com/TR07X11893) (NoMachine)
- [NVD - CVE-2026-114549](https://nvd.nist.gov/vuln/detail/CVE-2026-114549) (NVD / Zero Day Initiative)

---
Machine-readable: https://pwn.watch/i/nomachine-nxwebrunner-cve-2026-114549.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.