A critical flaw in the remote-desktop software NoMachine lets an attacker run code on a vulnerable system without any login at all. The vulnerability, tracked as CVE-2026-114549, scores 9.8 out of 10 for severity, the top end of the critical range.

The flaw sits in NoMachine's web service, which listens on TCP port 4443 by default. According to the Zero Day Initiative advisory, the service fails to check the length of user-supplied data before copying it into a heap-based buffer, a classic overflow weakness classified as CWE-122. An attacker can exploit that mistake remotely to execute code in the context of the service account, with no credentials and no interaction from a user needed.

Security researcher Sajeeb Lohani reported the flaw to the vendor on 24 July 2026, and the advisory was released publicly in a coordinated disclosure on 22 October. NoMachine has fixed the problem in versions 10.1.7, 9.9.6 and 8.27.1, and users should upgrade to the fixed release matching their installed branch. Version 9.7.3 is among the affected releases.

No exploitation in the wild has been confirmed, and no public exploit code has been reported, but the combination of a network-reachable flaw, no authentication and full code execution makes this one to patch quickly rather than queue for a routine window. Remote-desktop tools are a prime target for attackers looking for a first foothold inside a network, because a single compromised host can open the way to everything it can reach.

Administrators running NoMachine should check which version is installed, apply the fixed release, and confirm that the web service is not exposed to the internet unless it genuinely needs to be. Where remote access is required, it should sit behind a VPN or another authenticated gateway rather than facing the public web directly.