A local privilege escalation vulnerability in NoMachine allows authenticated users to execute arbitrary code with elevated service account permissions.

The vulnerability is caused by an uncontrolled search path element (CWE-427) where the application loads an OpenSSL configuration file from an insecure location. An attacker with low-privileged access to the local system can exploit this to achieve code execution in the context of the service account.

The ability for a local attacker to escalate privileges to a service account level poses a severe risk to system integrity and confidentiality. With a CVSS score of 7.8, this flaw could allow an adversary to bypass security controls, install persistent backdoors, or access sensitive data managed by the NoMachine service.

Immediate Action: Review the official NoMachine knowledge base (TR04W11314) and apply the vendor-provided security updates or configuration changes recommended for the affected agent version.

Proactive Monitoring: Monitor system logs for unauthorized attempts to modify configuration files or unexpected processes spawned by the NoMachine service account.

Compensating Controls: Implement strict file system permissions on the directories where OpenSSL configuration files are stored to prevent unauthorized users from placing malicious files in the search path.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Given the potential for complete system compromise via privilege escalation, administrators should prioritize the remediation of this vulnerability on all affected NoMachine agent installations. Until a patch is confirmed and applied, restricting local user access to the affected system directories is a critical defensive measure to prevent exploitation.