{"id":"CVE-2026-111184","kind":"vulnerability","aliases":["CVE-2026-111184"],"related":[],"title":"NoMachine: named pipe permissions let local users gain SYSTEM","description":"NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the NoMachine Device Service. The issue results from incorrect permissions on a named pipe. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-31213.","summary":"The NoMachine Device Service sets incorrect permissions on a named pipe. A local user with low privileges can abuse it to run code as SYSTEM on Windows.","severity":"high","cvss":7.8,"epss":0.00142,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop-remote-access","nomachine","runtime","windows"],"not_affected_if":["no-nomachine-installed"],"how_to_check":"- Check whether NoMachine is installed on Windows machines and note the installed version, which the sources do not give a command for\n- unknown","fix":"- Update NoMachine to a fixed release; the sources do not name the fixed version\n- unknown","status":"open","published_at":"2026-10-21T18:17:23+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:08:19+00:00","updated_at":"2026-10-25T03:08:19+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T03:08:19Z","model":"claude-haiku-5-5","output":{"fix":"- Update NoMachine to a fixed release; the sources do not name the fixed version\n- unknown","reach":"local","title":"NoMachine: named pipe permissions let local users gain SYSTEM","impact":"high","summary":"The NoMachine Device Service sets incorrect permissions on a named pipe. A local user with low privileges can abuse it to run code as SYSTEM on Windows.","category":"runtime","nicknames":[],"who_cares":["windows","nomachine","desktop-remote-access"],"confidence":0.6,"needs_auth":"yes","worst_case":"Low-privileged local code gains SYSTEM on the Windows host","analyst_note":"Find the affected and fixed NoMachine versions and a vendor advisory; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-111184 is the only source given.","how_to_check":"- Check whether NoMachine is installed on Windows machines and note the installed version, which the sources do not give a command for\n- unknown","needs_analyst":true,"not_affected_if":["no-nomachine-installed"],"who_is_affected":"Any Windows machine with NoMachine installed is exposed to a local user who can already run code on it. The sources do not say which NoMachine versions are affected. Systems without NoMachine can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000591,"input_tokens":3462,"output_tokens":489,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111184':12A,15A '-2026':11A,14A '31213':137C 'abil':79C 'abus':41B 'access':19B 'affect':69C 'allow':62C 'arbitrari':126C 'assign':55C 'attack':64C,74C,116C 'code':45B,85C,127C 'context':130C 'cve':10A,13A 'desktop':17B 'desktop-remote-access':16B 'devic':25B,103C 'escal':58C,66C,122C 'execut':81C,125C 'exist':99C 'exploit':93C 'first':76C 'flaw':98C 'gain':8A 'incorrect':28B,53C,109C 'instal':70C 'issu':106C 'let':5A 'leverag':118C 'local':6A,35B,56C,63C 'low':38B,83C 'low-privileg':82C 'must':75C 'name':2A,32B,51C,113C 'nomachin':1A,20B,24B,50C,72C,102C 'obtain':77C 'order':91C 'permiss':4A,29B,54C,110C 'pipe':3A,33B,52C,114C 'privileg':39B,57C,67C,84C,123C 'remot':18B 'result':107C 'run':44B 'runtim':21B 'servic':26B,104C 'set':27B 'specif':97C 'system':9A,47B,89C,132C 'target':88C 'user':7A,36B 'vulner':59C,61C,95C,120C 'window':22B,49B 'within':100C 'zdi':135C 'zdi-can':134C","nicknames":[],"mitigations":[],"who_affected":"Any Windows machine with NoMachine installed is exposed to a local user who can already run code on it. The sources do not say which NoMachine versions are affected. Systems without NoMachine can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T18:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111184","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111184","severity":null,"published_at":"2026-10-21T18:17:23+00:00","modified_at":"2026-10-23T12:18:08+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-111184","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111184","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}