CVE-2026-53694: Potential local privileges escalation through argument injection in the nxchmod.sh script

Synopsis

An argument injection vulnerability in NoMachine's nxchmod.sh script allows a local attacker with a low-privilege account to escalate privileges on the host. The vulnerability is reachable locally and requires no interaction from any other user, based on the CVSS vector (AV:L, PR:L, UI:N). Successful exploitation gives the attacker full read, write, and denial-of-service capability over the affected system. Patched-image rebuilds at versions 8.23.2 and 9.5.7 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no elevated or administrative credentials are needed to trigger the injection.

• Victim interactionNot required

  No action from another user or administrator is needed; the attacker can exploit the flaw entirely on their own.

• Attack complexityDetail

  Attack complexity is low overall, though the AT:P token indicates specific target conditions or configuration states must be present on the host for the exploit to succeed.

Blast Radius

• Reads sensitive files and data accessible on the host, including credentials, configuration, and session material.
• Modifies or overwrites files and system state on the host, enabling persistence or sabotage of running services.
• Crashes or disrupts the affected NoMachine service or other host processes, causing a denial of service.
• Because scope is confined to the local system (SC:N, SI:N, SA:N), impact does not propagate to adjacent container or network resources beyond the compromised host.