NoMachine Remote Desktop Privilege Escalation Vulnerabilities

CERT-Bund published security advisory WID-SEC-2026-0927 identifying multiple vulnerabilities in NoMachine remote desktop software (version <9.4.14) with CVSS Base Score 7.8 (high) and CVSS Temporal Score 6.8 (medium). The vulnerabilities affect Linux, UNIX, Windows, and other platforms. Attackers can exploit these vulnerabilities to manipulate files and escalate privileges. Remote attack is not possible. Mitigation is available. Paragraph 2: Organizations using NoMachine software should immediately identify if they are running affected versions and apply the available patch or mitigation. The update to version 9.4.14 or later addresses these vulnerabilities. No specific compliance deadline or penalties are mentioned.