{"id":"CVE-2026-92209","kind":"vulnerability","aliases":["CVE-2026-92209"],"related":[],"title":"NoMachine: weak Redis credentials let local users escalate privileges","description":"NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the authentication mechanism controlling access to the Redis database. The issue results from using insufficient entropy in the generation of credentials. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-30984.","summary":"NoMachine's Redis database authentication generates credentials with insufficient entropy, so a local user who already runs low-privileged code can guess or predict them. A successful attacker gains the privileges of the service account and can execute arbitrary code as that account.","severity":"high","cvss":7.8,"epss":0.00243,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux","macos","nomachine","package","remote-desktop","windows"],"not_affected_if":["single-user-machine"],"how_to_check":"- Check the installed NoMachine version on each host, for example by reading the version from the NoMachine install directory or package manager (unknown exact command from sources)\n- Confirm whether the bundled Redis instance is running locally with `ps aux | grep -i redis`","fix":"- Upgrade NoMachine to the fixed version listed by the vendor (unknown; sources do not name it)","status":"open","published_at":"2026-10-21T18:17:31+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:08:16+00:00","updated_at":"2026-10-25T03:08:16+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:08:16Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade NoMachine to the fixed version listed by the vendor (unknown; sources do not name it)","reach":"local","title":"NoMachine: weak Redis credentials let local users escalate privileges","impact":"high","summary":"NoMachine's Redis database authentication generates credentials with insufficient entropy, so a local user who already runs low-privileged code can guess or predict them. A successful attacker gains the privileges of the service account and can execute arbitrary code as that account.","category":"package","nicknames":[],"who_cares":["nomachine","linux","windows","macos","remote-desktop"],"confidence":0.6,"needs_auth":"yes","worst_case":"Local user gains service account privileges and runs arbitrary code","analyst_note":"Find the fixed NoMachine version and the vendor advisory for ZDI-CAN-30984; the sources give neither.","how_to_check":"- Check the installed NoMachine version on each host, for example by reading the version from the NoMachine install directory or package manager (unknown exact command from sources)\n- Confirm whether the bundled Redis instance is running locally with `ps aux | grep -i redis`","needs_analyst":true,"not_affected_if":["single-user-machine"],"who_is_affected":"Hosts running NoMachine where a local, non-privileged user can run code, such as shared multi-user servers or workstations. The sources do not say whether default installs enable the vulnerable Redis component, so the configuration is unknown. Systems where only trusted administrators have local logins are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000625,"input_tokens":3454,"output_tokens":559,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-92209':12A,15A '30984':162C 'abil':95C 'access':121C 'account':59B,67B,157C 'affect':85C 'allow':78C 'alreadi':39B 'arbitrari':63B,149C 'attack':52B,80C,90C,139C 'authent':28B,71C,118C 'code':44B,64B,101C,150C 'context':153C 'control':120C 'credenti':4A,30B,137C 'cve':10A,13A 'databas':27B,125C 'desktop':22B 'entropi':33B,132C 'escal':8A,74C,82C,145C 'execut':62B,97C,148C 'exist':115C 'exploit':109C 'first':92C 'flaw':114C 'gain':53B 'generat':29B,135C 'guess':46B 'improp':70C 'instal':86C 'insuffici':32B,131C 'issu':127C 'let':5A 'leverag':141C 'linux':16B 'local':6A,36B,72C,79C 'low':42B,99C 'low-privileg':41B,98C 'maco':17B 'mechan':119C 'must':91C 'nomachin':1A,18B,24B,68C,88C 'obtain':93C 'order':107C 'packag':19B 'predict':48B 'privileg':9A,43B,55B,73C,83C,100C,146C 'redi':3A,26B,69C,124C 'remot':21B 'remote-desktop':20B 'result':128C 'run':40B 'servic':58B,156C 'specif':113C 'success':51B 'system':105C 'target':104C 'use':130C 'user':7A,37B 'vulner':75C,77C,111C,143C 'weak':2A 'window':23B 'within':116C 'zdi':160C 'zdi-can':159C","nicknames":[],"mitigations":[],"who_affected":"Hosts running NoMachine where a local, non-privileged user can run code, such as shared multi-user servers or workstations. The sources do not say whether default installs enable the vulnerable Redis component, so the configuration is unknown. Systems where only trusted administrators have local logins are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T18:17:31+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92209","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92209","severity":null,"published_at":"2026-10-21T18:17:31+00:00","modified_at":"2026-10-23T12:18:18+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-92209","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92209","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}