ZDI 2026-09-16

ZDI-26-712: NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability

CVE-2026-92210

Machine-generated analysis · WAYSCloud LLM

Unauthenticated attackers can exploit an SSRF flaw in NoMachine’s nxhtd service to issue arbitrary server-side requests.

Context

The advisory concerns the NoMachine nxhtd service. It describes a server-side request forgery (SSRF) that also results in information disclosure. Exploitation does not require authentication.

Operator considerations

Check: Confirm whether the nxhtd service is enabled and listening on the network.
Isolate: If feasible, limit network access to nxhtd to trusted hosts or internal segments.
Log: Enable detailed request logging for nxhtd to capture unexpected outbound connections.

From Zero Day Initiative ↗

This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-92210.

Read the full advisory on ZDI →