---
id: "CVE-2026-111184"
kind: "vulnerability"
aliases: ["CVE-2026-111184"]
title: "NoMachine: named pipe permissions let local users gain SYSTEM"
severity: "high"
cvss: 7.8
epss: 0.00142
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["desktop-remote-access", "nomachine", "runtime", "windows"]
not_affected_if: ["no-nomachine-installed"]
published_at: "2026-10-21T18:17:23+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T03:08:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111184", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-111184", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# NoMachine: named pipe permissions let local users gain SYSTEM

The NoMachine Device Service sets incorrect permissions on a named pipe. A local user with low privileges can abuse it to run code as SYSTEM on Windows.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether NoMachine is installed on Windows machines and note the installed version, which the sources do not give a command for
- unknown

## Fix

- Update NoMachine to a fixed release; the sources do not name the fixed version
- unknown

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111184
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-111184

## From the sources

NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the NoMachine Device Service. The issue results from incorrect permissions on a named pipe. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-31213.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_