Live › vulnerability › CVE-2026-92210
Go to dashboardThe NoMachine nxhtd web service does not validate a URI before fetching it, so a remote attacker can make the server send requests on their behalf. This can expose information from resources the server can reach, such as internal services.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Hosts running a NoMachine server (commercial server packages that include the nxhtd web service) older than 10.1.7, 9.9.6 or 8.27.1 per branch. The web service listens on port 4443 by default per ZDI and needs no login, so an attacker who can reach it can make the server fetch internal URLs, which matters most for servers with access to internal services or cloud metadata. Client-only installs and hosts where 4443 is blocked from untrusted networks can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| NoMachine | vendor | unknown lower bound; below 10.1.7 / 9.9.6 / 8.27.1 | 10.1.7, 9.9.6, 8.27.1 |
10.1.7, 9.9.6 or 8.27.1 or later on your branch (later releases 10.2.3, 9.10.3, 8.28.2 also exist; vendor says 9.10.3 and 8.28.2 carry further server-side security patches and an updated nxhtd)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of NoMachine. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the web service, which listens on UDP port 4443 by default. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to initiate requests in the context of the service account. Was ZDI-CAN-31619.
This page as .md · .json · in your agent: get_signal("CVE-2026-92210")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.