{"id":"CVE-2026-92210","kind":"vulnerability","aliases":["CVE-2026-92210"],"related":[],"title":"NoMachine nxhtd: unauthenticated server-side request forgery leaks internal information","description":"NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of NoMachine. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the web service, which listens on UDP port 4443 by default. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to initiate requests in the context of the service account. Was ZDI-CAN-31619.","summary":"The NoMachine nxhtd web service does not validate a URI before fetching it, so a remote attacker can make the server send requests on their behalf. This can expose information from resources the server can reach, such as internal services.","severity":"high","cvss":7.2,"epss":0.00327,"exploited":false,"exploited_at":null,"products":[{"name":"NoMachine","fixed":["10.1.7","9.9.6","8.27.1"],"affected":"unknown lower bound; below 10.1.7 / 9.9.6 / 8.27.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["nomachine","other","remote-desktop","self-hosted","ssrf"],"not_affected_if":["no-nomachine-installed","no-nomachine-server","patched-version","port-4443-blocked","udp-4443-blocked"],"how_to_check":"- Run the NoMachine server's version check (nxserver --version, or the About dialog) and compare to fixed 10.1.7 / 9.9.6 / 8.27.1\n- Check for nxhtd listening on port 4443: ss -ulpn | grep 4443 (ZDI says UDP; also check ss -tlpn | grep 4443)","fix":"Upgrade NoMachine to 10.1.7, 9.9.6 or 8.27.1 or later on your branch (later releases 10.2.3, 9.10.3, 8.28.2 also exist; vendor says 9.10.3 and 8.28.2 carry further server-side security patches and an updated nxhtd). Per ZDI-26-712.","status":"open","published_at":"2026-10-21T18:17:31+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:29:00+00:00","updated_at":"2026-10-25T03:30:11+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-10-25T03:29:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"NoMachine nxhtd: unauthenticated server-side request forgery leaks internal information","impact":"medium","summary":"The NoMachine nxhtd web service does not validate a URI before fetching it, so a remote attacker can make the server send requests on their behalf. This can expose information from resources the server can reach, such as internal services.","category":"other","nicknames":[],"who_cares":["nomachine","remote-desktop","self-hosted"],"confidence":0.5,"needs_auth":"no","worst_case":"Attacker reads internal resources reachable from the server.","analyst_note":"Find the affected NoMachine versions and the fixed release from the NVD entry and the ZDI advisory (ZDI-CAN-31619); confirm whether the nxhtd service is enabled by default.","how_to_check":"- Confirm whether NoMachine is installed on the host and note its version, as the sources do not name affected versions\n- Check whether the nxhtd web service listens on UDP port 4443 (for example with `ss -ulpn | grep 4443`)","needs_analyst":true,"not_affected_if":["no-nomachine-installed","udp-4443-blocked"],"who_is_affected":"Teams running NoMachine servers where the nxhtd web service is reachable over the network on its default UDP port 4443. The sources do not name affected versions or a patch, so unknown whether a fixed release exists. Hosts where NoMachine is not installed, or where UDP 4443 is blocked from untrusted networks, are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000627,"input_tokens":3442,"output_tokens":566,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected NoMachine versions and the fixed release from the NVD entry and the ZDI advisory (ZDI-CAN-31619); confirm whether the nxhtd service is enabled by default.","search":"'-2026':13A,16A '-92210':14A,17A '31619':155C '4443':116C 'access':133C 'account':150C 'affect':91C 'allow':80C 'arbitrari':85C 'attack':44B,82C,136C 'authent':95C 'behalf':53B 'context':146C 'cve':12A,15A 'default':118C 'desktop':23B 'disclosur':76C 'exist':106C 'exploit':100C 'expos':56B 'fetch':39B 'flaw':105C 'forgeri':8A,74C 'host':26B 'inform':11A,57B,75C 'initi':84C,142C 'instal':92C 'intern':10A,66B 'issu':120C 'lack':124C 'leak':9A 'leverag':138C 'listen':112C 'make':46B 'nomachin':1A,19B,29B,68C,94C 'nomachine':18A 'nxhtd':2A,30B,69C 'port':115C 'prior':131C 'proper':126C 'reach':63B 'remot':22B,43B,81C 'remote-desktop':21B 'request':7A,50B,73C,89C,143C 'requir':98C 'resourc':59B,134C 'result':121C 'self':25B 'self-host':24B 'send':49B 'server':5A,48B,61B,71C,87C 'server-sid':4A,70C,86C 'servic':32B,67B,110C,149C 'side':6A,72C,88C 'specif':104C 'ssrf':27B 'udp':114C 'unauthent':3A 'uri':37B,130C 'valid':35B,127C 'vulner':77C,79C,102C,140C 'web':31B,109C 'within':107C 'zdi':153C 'zdi-can':152C","nicknames":[],"mitigations":[],"who_affected":"Hosts running a NoMachine server (commercial server packages that include the nxhtd web service) older than 10.1.7, 9.9.6 or 8.27.1 per branch. The web service listens on port 4443 by default per ZDI and needs no login, so an attacker who can reach it can make the server fetch internal URLs, which matters most for servers with access to internal services or cloud metadata. Client-only installs and hosts where 4443 is blocked from untrusted networks can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T18:17:31+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92210","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92210","severity":null,"published_at":"2026-10-21T18:17:31+00:00","modified_at":"2026-10-22T17:34:37+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-92210","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92210","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-92210:730","url":null,"severity":null,"published_at":"2026-10-25T03:30:11+00:00","modified_at":"2026-10-25T03:30:11+00:00","first_seen_at":"2026-10-25T03:30:11+00:00","fetched_at":"2026-10-25T03:30:11+00:00","note":"ZDI-26-712 (reported by Niels Pfau, Mantodea Security) says fixed in NoMachine 10.1.7, 9.9.6, 8.27.1; vendor KB 8.27.1 notes list an unnumbered 'possible SSRF in Web Player' (TR08X11930), consistent but no CVE cited. Affected lower bounds unknown. ZDI says port 4443 is the default; nxhtd ships in commercial server packages. No exploitation or PoC found. Nothing marked verified (fix comes from ZDI, not a vendor page naming the CVE)."}],"documents":[{"id":3196,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-712/","title":"ZDI-26-712 NoMachine nxhtd SSRF","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3197,"url":"https://kb.nomachine.com/SU09X00289","title":"NoMachine 8.27.1 release notes","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":3198,"url":"https://kb.nomachine.com/SU10X00291","title":"NoMachine 9.10.3 release notes","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}