A command injection flaw in the NoMachine web service allows an attacker who authenticates to the service to supply an arbitrary string that is executed as a system command. The vulnerability can be exploited to run arbitrary code with the privileges of the service account, potentially compromising the host or enabling lateral movement.

The flaw affects installations of NoMachine that expose its web service on TCP port 4000. No specific product version is listed in the advisory, so all deployments that enable this service are potentially vulnerable.

The CVSS score of 8.8 indicates a high severity exposure. An EPSS score of 1% indicates a low exploitation probability, and the lack of inclusion in the CISA KEV catalog suggests that public exploitation is currently low or undocumented. The vulnerability requires only network access to port 4000 and authenticated credentials, which are often available to remote users on local networks.