A command injection flaw in the NoMachine web service allows an attacker who authenticates to the service to supply an arbitrary string that is executed as a system command. The vulnerability can be exploited to run arbitrary code with the privileges of the service account, potentially compromising the host or enabling lateral movement.

The flaw affects installations of NoMachine that expose its web service on TCP port 4000. No specific product version is listed in the advisory, so all deployments that enable this service are potentially vulnerable.

The CVSS score of 8.8 indicates a high severity exposure. The absence of an available EPSS score and the lack of inclusion in the CISA KEV catalog suggest that public exploitation is currently low or undocumented, yet the vulnerability requires only network access to port 4000 and authenticated credentials, which are often available to remote users on local networks.