CVE-2026-5053

CVE-2026-5053 is an arbitrary file deletion vulnerability affecting NoMachine that stems from improper validation of user-supplied file paths in environment variable handling. A local attacker with low-privileged code execution capabilities can exploit this flaw to delete arbitrary files with root-level privileges on vulnerable systems. The vulnerability presents a high severity risk with a CVSS score of 7.1, requiring local access but minimal user interaction or special configuration to exploit. The attack vector is local with low complexity, and while confidentiality is not impacted, the vulnerability enables significant integrity and availability damage through root-level file deletion. There is currently no evidence of active exploitation in the wild. The vulnerability does not appear on the Known Exploited Vulnerabilities catalog, and it maintains an inactive status on threat intelligence hot lists. The EPSS score of 0.00017 indicates this remains a relatively low-probability target for widespread exploitation attempts at this time.