{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-18264", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "state": "PUBLISHED", "assignerShortName": "zdi", "dateReserved": "2026-07-29T16:58:15.812Z", "datePublished": "2026-08-20T16:13:11.390Z", "dateUpdated": "2026-08-26T19:50:17.572Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2026-08-20T16:13:11.390Z"}, "title": "NoMachine getstat Command Injection Remote Code Execution Vulnerability", "descriptions": [{"lang": "en", "value": "NoMachine getstat Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the web service, which listens on TCP port 4000 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account.\n. Was ZDI-CAN-30634."}], "affected": [{"vendor": "NoMachine", "product": "NoMachine", "versions": [{"version": "9.7.3", "status": "affected"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}], "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-483/", "name": "ZDI-26-483", "tags": ["x_research-advisory"]}, {"url": "https://kb.nomachine.com/TR06X11869", "name": "vendor-provided URL", "tags": ["vendor-advisory"]}], "dateAssigned": "2026-07-29T16:58:15.840Z", "datePublic": "2026-07-29T21:44:28.893Z", "source": {"lang": "en", "value": "Sajeeb Lohani"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-26T19:41:59.748000Z", "id": "CVE-2026-18264", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-26T19:50:17.572Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-18264", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-26T19:41:59.748000Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-26T19:50:11.323Z"}}], "cna": {"title": "NoMachine getstat Command Injection Remote Code Execution Vulnerability", "source": {"lang": "en", "value": "Sajeeb Lohani"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "NoMachine", "product": "NoMachine", "versions": [{"status": "affected", "version": "9.7.3"}], "defaultStatus": "unknown"}], "datePublic": "2026-07-29T21:44:28.893Z", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-483/", "name": "ZDI-26-483", "tags": ["x_research-advisory"]}, {"url": "https://kb.nomachine.com/TR06X11869", "name": "vendor-provided URL", "tags": ["vendor-advisory"]}], "dateAssigned": "2026-07-29T16:58:15.840Z", "descriptions": [{"lang": "en", "value": "NoMachine getstat Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the web service, which listens on TCP port 4000 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account.\n. Was ZDI-CAN-30634."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2026-08-20T16:13:11.390Z"}}}, "cveMetadata": {"cveId": "CVE-2026-18264", "state": "PUBLISHED", "dateUpdated": "2026-08-26T19:50:17.572Z", "dateReserved": "2026-07-29T16:58:15.812Z", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "datePublished": "2026-08-20T16:13:11.390Z", "assignerShortName": "zdi"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "NoMachine", "vendor": "NoMachine", "versions": [{"status": "affected", "version": "9.7.3"}]}], "source": "zdi-disclosures@trendmicro.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "NoMachine getstat Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the web service, which listens on TCP port 4000 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account.\n. Was ZDI-CAN-30634."}], "id": "CVE-2026-18264", "lastModified": "2026-09-01T20:57:57.143", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18264", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-26T19:41:59.748000Z", "version": "2.0.3"}}]}, "published": "2026-08-20T17:17:22.890", "references": [{"source": "zdi-disclosures@trendmicro.com", "url": "https://kb.nomachine.com/TR06X11869"}, {"source": "zdi-disclosures@trendmicro.com", "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-483/"}], "sourceIdentifier": "zdi-disclosures@trendmicro.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "9.7.3"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "NoMachine", "source": "cna", "vendor": "NoMachine"}, "product": "nomachine", "vendor": "nomachine"}], "created": "2026-08-20T18:15:03.726766+00:00", "updated": "2026-08-24T16:15:04.538333+00:00", "vendors": ["nomachine", "nomachine$PRODUCT$nomachine"]}