Vulnerabilities
NoMachine Redis Authentication Flaw Enables Local Privilege Escalation (CVE-2026-92209)
A flaw in NoMachine’s Redis authentication allows local attackers to elevate privileges after gaining low‑privileged code execution. The issue stems from weak credential generation and affects versions prior to v10.1.7, v9.9.6, and v8.27.1. Defenders should patch immediately and monitor for local privilege escalation attempts.
Defenders should be aware that NoMachine’s Redis authentication mechanism has been found to use insufficient entropy, allowing local attackers who have already executed low‑privileged code to elevate to the service account and run arbitrary code.
What Happened
A flaw in the credential generation for the Redis database exposed a local privilege escalation path. The vulnerability requires local code execution and is limited to systems running NoMachine versions before 10.1.7, 9.9.6, or 8.27.1.
Impact
Once exploited, an attacker can gain full control of the NoMachine service process, potentially compromising the host and any connected systems. The CVSS score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Mitigation
- Patch all affected NoMachine installations to v10.1.7, v9.9.6, or v8.27.1 or later.
- Verify that the Redis authentication module is correctly configured and that credential entropy is adequate.
- Implement local privilege escalation monitoring and restrict local code execution privileges.
Recommended Actions
Immediately apply the vendor patch, validate the update, and review audit logs for any signs of local privilege escalation. If patching cannot be performed immediately, isolate the affected hosts and enforce strict local execution controls.
Related vulnerabilities
CVE-2026-70104: Windows Win32k Privilege Escalation Vulnerability
A local privilege escalation flaw in the Windows Win32 kernel subsystem allows an authenticated user to gain elevated rights by dereferencing an untrusted pointer. Microsoft has issued a patch; defenders should update systems immediately and verify that the kernel component is patched.
Read briefing
Windows License Manager Privilege Escalation Vulnerability (CVE‑2026‑62777)
Microsoft has disclosed a local privilege‑escalation flaw in the Windows License Manager component. The vulnerability could allow an attacker with local access to gain SYSTEM rights. Defenders should monitor for suspicious activity and apply the forthcoming update when available.
Read briefing
CVE-2026-70108: Windows Win32k Heap Overflow Enables Local Privilege Escalation
Microsoft disclosed CVE‑2026‑70108, a heap‑based buffer overflow in the Win32 kernel subsystem that lets an authenticated local user elevate privileges. The flaw is present in all current Windows releases until patched. Defenders should apply the latest cumulative update and monitor for anomalous privilege changes.
Read briefing
CVE-2026-83518: RPC Runtime Heap Overflow Enables Local Privilege Escalation on Windows
A heap-based buffer overflow in the Windows RPC Runtime (CVE‑2026‑83518) allows an attacker with local access to gain elevated privileges. The flaw is exploitable only by users who already have some level of access, making it a targeted privilege‑escalation vector. Defenders should apply the latest Microsoft patch, enforce least‑privilege policies, and monitor for anomalous local privilege changes.
Read briefing