CVE-2026-92210

Awaiting Analysis Awaiting Analysis - Queue

NoMachine nxhtd Server-Side Request Forgery Information Disclosure

Publication date: 2026-10-21

Last updated on: 2026-10-30

Assigner: Zero Day Initiative

Description

NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service, which listens on UDP port 4443 by default. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to initiate requests in the context of the service account. Was ZDI-CAN-31619.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-92210

EUVD

EUVD-2026-107399

Affected Vendors & Products

Vendor	Product	Version / Range
NoMachine	NoMachine	nomachine_9.8.2_1_amd64.deb

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This is a Server-Side Request Forgery (SSRF) and Information Disclosure vulnerability in NoMachine software. It allows remote attackers to initiate arbitrary server-side requests without authentication by exploiting improper URI validation in the web service listening on UDP port 4443. Successful exploitation could enable attackers to make requests in the context of the service account.

Detection Guidance

To detect this vulnerability, check if NoMachine software versions prior to v10.1.7, v9.9.6, or v8.27.1 are running on your system. Verify if the web service is listening on UDP port 4443. Use commands like 'netstat -tulnp | grep 4443' or 'ss -tulnp | grep 4443' to check for open ports.

Impact Analysis

An attacker could exploit this to access internal resources, disclose sensitive information, or perform unauthorized actions on behalf of the service account. This may lead to data breaches, unauthorized system access, or further network compromise depending on the service account's privileges.

Mitigation Strategies

Immediately update NoMachine to the latest fixed versions: v10.1.7, v9.9.6, or v8.27.1 or later. If updating is not possible, consider disabling the web service or blocking UDP port 4443 at the network perimeter to prevent exploitation.

Hi! I’m here to help you understand CVE-2026-92210. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...