Nomachine
Security incidents tagged Nomachine. Newest first.
1 Nomachine incident in the last 12 months
- Incidents
- 1
- Live
- 1
- Patched
- 1
- Days without an incident
- 8
- Longest quiet run: 6 days (Oct 28–Nov 2)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
- Patched
NoMachine web player heap overflow lets unauthenticated attackers run code (CVE-2026-114549)
Zero Day Initiative and NoMachine disclosed CVE-2026-114549, a pre-authentication heap buffer overflow in NoMachine's nxwebrunner web service (default TCP 4443). Unauthenticated remote attackers can execute code as the service account (CVSS 3.0 9.8). NoMachine's trouble report says the bug is fixed in 10.1.7, 9.9.6 and 8.27.1 (solved versions published Oct 27 2026); the CVE record was published around Nov 3–4 2026. Affected lines include 8.27 before 8.27.1, 9.9 before 9.9.6 and 10.1 before 10.1.7. Upgrade immediately; until then restrict or disable access to the web player port. No public exploit or CISA KEV listing was reported at publication.
NoMachine (nxwebrunner / Web Player)Since Oct 27, 2026
