CVE-2026-114549

waiting for further signals

EUVD-2026-116625 ↗

no check availablenot proven exploitable

cve.orgpublic pockev

NoMachine 9.7.3

CWE-122 Heap-based Buffer Overflow

ETK-2026-3420, permanent identifier

cvss9.8cna vendorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4h 13msince last run

44mAI analysis

timeline

0 = cve.org publication

trigger signal (cve.org) +0hwaiting for further signals+1h16m

+2h

+4h

+6h

+8h

+10h

+12h

description

NoMachine installations with the nxwebrunner web service are affected by a heap-based buffer overflow. A remote unauthenticated attacker may execute code as the service account when they can reach the web service, which listens on TCP port 4443 by default.

mitigation

Restrict access to the nxwebrunner web service, especially TCP port 4443, to trusted administrative networks until an update is confirmed. Monitor NoMachine security advisories for a vendor-fixed release; no fixed version is recorded in the available advisory data.

check

exploit

automation

contextual

auth required

EPSS

–

agent run time

44m

cve.org record, t = 0

2026-11-03 23:46Z

Δ to public poc

–

Δ to kev

–

outcome

Contextual, not validated: no deterministic check could cover this one, and no technique passed our review.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-11-03 23:46Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-114549

this entry in the feed

GET /api/v1/feed/CVE-2026-114549

{
  "etk_id": "ETK-2026-3420",
  "cve_id": "CVE-2026-114549",
  "display_id": "CVE-2026-114549",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-116625",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated heap buffer overflow in NoMachine nxwebrunner",
  "summary": "NoMachine installations with the nxwebrunner web service are affected by a heap-based buffer overflow. A remote unauthenticated attacker may execute code as the service account when they can reach the web service, which listens on TCP port 4443 by default.",
  "mitigation": "Restrict access to the nxwebrunner web service, especially TCP port 4443, to trusted administrative networks until an update is confirmed. Monitor NoMachine security advisories for a vendor-fixed release; no fixed version is recorded in the available advisory data.",
  "vendor": "NoMachine",
  "product": "NoMachine",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "9.7.3"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "NoMachine",
      "purl": null
    }
  ],
  "cwes": [
    122
  ],
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 44.05631976666667,
  "t0_at": "2026-11-03T23:46:39.428000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-03T23:46:39.428000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-03T23:46:39.428000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114549"
    }
  }
}

published 2026-11-04 00:18Z
last change 2026-11-04 04:08Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.