Loading story…
NoMachine fixed two local vulnerabilities in version 9.4.14 that could let an attacker with low-privileged code execution escalate impact on affected systems. One issue, tracked as CVE-2026-5053 and ZDI-26-247, stems from improper validation of a user-supplied path in environment variable handling and can be abused to delete arbitrary files with root privileges. The flaw was assigned a CVSS 7.1 score.
A second flaw, CVE-2026-5055 / ZDI-26-249, affects the NoMachine Device Server and arises from loading a library from an unsecured location, creating an uncontrolled search path element vulnerability. Successful exploitation could allow arbitrary code execution with SYSTEM privileges, and the issue received a CVSS 7.8 score. Trend Micro's Zero Day Initiative disclosed both advisories publicly after coordinated reporting to the vendor, and credited khongtrang with discovering the privilege-escalation bug.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
Trend Micro's Zero Day Initiative published coordinated advisories for CVE-2026-5053 (ZDI-26-247) and CVE-2026-5055 (ZDI-26-249). The disclosures described local attacks that could delete arbitrary files as root or execute code with SYSTEM privileges after low-privileged code execution.
NoMachine addressed both disclosed vulnerabilities in version 9.4.14, including the arbitrary file deletion issue and the Device Server uncontrolled search path flaw. The references identify this version as the fix for both CVE-2026-5053 and CVE-2026-5055.
NoMachine published a knowledge base notice stating that version 9.4.14 was available for download. This vendor release predates later public vulnerability disclosures and corresponds to the version that fixed the reported local privilege escalation flaws.
A separate NoMachine vulnerability, later tracked as CVE-2026-5053 and ZDI-26-247, was reported to the vendor. The issue stemmed from improper validation of a user-supplied path in environment variable handling, enabling arbitrary file deletion with root privileges.
A local privilege escalation vulnerability in the NoMachine Device Server, later tracked as CVE-2026-5055 and ZDI-26-249, was reported to NoMachine. The flaw involved loading a library from an unsecured location, allowing low-privileged users to gain SYSTEM privileges.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
kb.nomachine.com
Open sourcezerodayinitiative.com
Open sourcezerodayinitiative.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed and patched several Windows elevation-of-privilege vulnerabilities affecting networking-related components, including **Windows Remote Access Connection Manager**, **Windows SMB Server**, and **Network Connection Status Indicator (NCSI)**. The issues tracked as `CVE-2025-62474`, `CVE-2025-62472`, `CVE-2025-47955`, `CVE-2025-59201`, and `CVE-2025-58726` could allow attackers with limited access to gain higher privileges on targeted systems, extending a pattern of privilege-escalation risk previously seen in the same Remote Access Connection Manager component with `CVE-2022-21914`. Among the disclosed flaws, Microsoft provided additional detail for **`CVE-2025-58726`**, describing an **Important** improper access control issue in **Windows SMB Server** that can let an authorized low-privilege attacker elevate to **SYSTEM** over the network by coercing a victim machine to authenticate to an attacker-controlled SMB server using a specially crafted script. Microsoft assigned the bug **CWE-284** and a **CVSS v3.1 score of 7.5**, said exploitation required specific conditions involving an unused or nonexistent Service Principal Name on the target, and stated that the vulnerability was neither publicly disclosed nor exploited in the wild at publication and that a security fix was available.
Jun 29, 2026
Microsoft disclosed **CVE-2025-49738**, an **Important** elevation-of-privilege vulnerability in **Microsoft PC Manager** that could allow a locally authorized attacker with low privileges to escalate to **SYSTEM** without user interaction. The issue stems from improper link resolution before file access, tracked as **`CWE-59`**, and carries a **CVSS 3.1 score of 7.8**. Microsoft said an official fix is available and assessed exploitation as **less likely**. The company also stated the flaw had **not been publicly disclosed** and was **not known to be exploited** at the time of publication. The vulnerability was credited to security researcher **Simon (`@sim0nsecurity`)** through coordinated vulnerability disclosure.
Jun 29, 2026
Two high-severity vulnerabilities were disclosed affecting exposed application and device management surfaces, including a flaw that can give attackers **root access** and another that enables **arbitrary file write** through path traversal. **CVE-2026-3587** describes an unauthenticated remote attack path in a hidden CLI function that lets an attacker escape a restricted prompt and gain root access to the underlying Linux operating system, potentially leading to full device compromise. The issue was mapped to `CWE-912` and assigned a `CVSS v3.1` score vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`, with CERT VDE publishing advisory `VDE-2026-020`. A separate vulnerability, **CVE-2026-5027**, affects Langflow's `POST /api/v2/files` endpoint, where improper sanitization of the multipart `filename` parameter allows path traversal using `../` sequences. An authenticated attacker can exploit the bug to write files to arbitrary filesystem locations, creating a route to compromise confidentiality, integrity, and availability. The flaw was classified as `CWE-22`, carries the `CVSS v3.1` vector `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, and is referenced in Tenable advisory `TRA-2026-26`.
Jun 29, 2026