CVE-2026-92209: NoMachine Redis Improper Authentication Local Privilege Escalation — Detection and Remediation Guide

---
title: Unauthenticated Redis Interaction by Non-NoMachine Process
description: Detects processes other than legitimate NoMachine/Redis components establishing local connections to the Redis default port or executing redis-cli, indicative of abuse of the unauthenticated bundled Redis instance in CVE-2026-92209.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-711/
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/04/06
id: 3f8a1b92-7c4d-4e61-9a2b-5d6e7f8a9b0c
status: experimental
logsource:
  category: network_connection
  product: windows
detection:
  selection_port:
    DestinationPort:
      - 6379
      - 6380
  filter_legitimate:
    Image|endswith:
      - '\redis-server.exe'
      - '\nxserver.bin'
      - '\nxnode.bin'
  condition: selection_port and not filter_legitimate
falsepositives:
  - Developers running local Redis clients on workstations where Redis is intentionally deployed
level: high
---
title: Privileged Redis or NoMachine Service Spawning Suspicious Child Process
description: Detects redis-server or NoMachine service binaries spawning shells, script interpreters, or system utilities — a strong indicator of successful privilege escalation via Redis module load or config abuse (CVE-2026-92209).
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-711/
  - https://attack.mitre.org/techniques/T1068/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
id: 8c2d4e6f-1a3b-4c5d-8e7f-9a0b1c2d3e4f
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\redis-server.exe'
      - '\nxserver.bin'
      - '\nxservice.bin'
      - '\nxnode.bin'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\mshta.exe'
      - '\net.exe'
      - '\net1.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; NoMachine service processes should not routinely spawn shells or admin utilities
level: critical
---
title: Redis Client Execution by Non-Administrative Context
description: Detects execution of redis-cli or ad-hoc Redis interaction tooling on systems running NoMachine, potentially indicating an attacker probing the unauthenticated bundled Redis instance.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-711/
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/04/06
id: 5e7f9a1b-2c4d-4e6f-8a9b-0c1d2e3f4a5b
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\redis-cli.exe'
  selection_cli:
    CommandLine|contains:
      - 'MODULE LOAD'
      - 'CONFIG SET'
      - 'CONFIG GET dir'
      - 'SLAVEOF'
      - 'REPLICAOF'
      - 'DEBUG SLEEP'
  condition: selection_img or selection_cli
falsepositives:
  - Legitimate Redis administration on hosts where Redis is a sanctioned workload
level: medium

// Hunt: NoMachine Redis LPE (CVE-2026-92209) — suspicious Redis interaction & service child processes
let Lookback = 7d;
let RedisPorts = dynamic([6379, 6380]);
let NoMachineProcs = dynamic(["redis-server.exe", "nxserver.bin", "nxservice.bin", "nxnode.bin", "redis-server"]);
let SuspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "mshta.exe", "net.exe", "sh", "bash", "nc", "ncat"]);
// Part 1: Non-NoMachine processes connecting to local Redis listener
DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where RemotePort in (RedisPorts)
| where RemoteIP in ("127.0.0.1", "::1") or RemoteIP startswith "127."
| where InitiatingProcessFileName !in~ (NoMachineProcs)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, RemoteIP, RemotePort
| extend HuntSignal = "UnexpectedLocalRedisConnection"
| union (
    // Part 2: Privileged NoMachine/Redis service spawning suspicious child processes
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where InitiatingProcessFileName in~ (NoMachineProcs)
    | where FileName in~ (SuspiciousChildren)
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine
    | extend HuntSignal = "NoMachineServiceSpawnedShell"
)
| sort by TimeGenerated desc

-- CVE-2026-92209 Hunt: Identify processes with connections to local Redis listeners
-- Flags any non-NoMachine/Redis process connected to common Redis ports
LET redis_ports <= (6379, 6380)
LET suspicious_conns <= SELECT Pid, Name, Path, Status, Family, Type,
       Laddr.IP AS LocalIP, Laddr.Port AS LocalPort,
       Raddr.IP AS RemoteIP, Raddr.Port AS RemotePort
FROM netstat()
WHERE (RemotePort in redis_ports OR LocalPort in redis_ports)
  AND NOT Path =~ '(?i)(redis-server|nxserver|nxservice|nxnode)'
SELECT LocalIP, LocalPort, RemoteIP, RemotePort, Pid, Name, Path, Status,
       timestamp(epoch=now()) AS CollectionTime
FROM suspicious_conns

#!/bin/bash
# CVE-2026-92209 verification: NoMachine bundled Redis exposure check
# Run with elevated privileges on Linux/macOS hosts.

echo "=== [1] NoMachine installation check ==="
if command -v nxserver >/dev/null 2>&1; then
  /etc/NX/nxserver --version 2>/dev/null || nxserver --version 2>/dev/null
elif [ -d /usr/NX ] || [ -d /etc/NX ]; then
  echo "NoMachine directories present: /usr/NX or /etc/NX"
else
  echo "NoMachine not detected on this host."; fi

echo ""
echo "=== [2] Listening Redis sockets (6379/6380 and unix sockets) ==="
ss -lntup 2>/dev/null | grep -Ei ':(6379|6380)\b' || echo "No TCP Redis listener found."
ls -la /tmp/*.sock /var/run/*.sock /usr/NX/var/*.sock 2>/dev/null | grep -i redis || echo "No obvious Redis unix socket found."

echo ""
echo "=== [3] Authentication probe on local Redis (expect NOAUTH or error if secured) ==="
for port in 6379 6380; do
  if ss -lnt 2>/dev/null | grep -q ":$port "; then
    RESP=$(printf 'PING\r\n' | timeout 2 nc 127.0.0.1 $port 2>/dev/null | head -1)
    echo "Port $port response: ${RESP:-<none>}"
    if echo "$RESP" | grep -q '+PONG'; then
      echo "!!! WARNING: Redis on port $port responds to PING without authentication — VULNERABLE configuration"
    elif echo "$RESP" | grep -qi 'NOAUTH\|DENIED'; then
      echo "OK: Redis on port $port requires authentication."
    fi
  fi
done

echo ""
echo "=== [4] Redis process privilege context ==="
ps -eo user,pid,comm,args 2>/dev/null | grep -i '[r]edis' || echo "No redis-server process running."

echo ""
echo "=== [5] Check for loaded Redis modules (potential post-exploitation artifact) ==="
for port in 6379 6380; do
  printf 'MODULE LIST\r\n' | timeout 2 nc 127.0.0.1 $port 2>/dev/null | grep -vi '\*0\|NOAUTH' && echo "^ Modules returned on port $port — investigate" || true
done

# CVE-2026-92209 verification: NoMachine + bundled Redis exposure on Windows
# Run in an elevated PowerShell session.

Write-Host "=== [1] NoMachine installation check ===" -ForegroundColor Cyan
$nxPaths = @("$env:ProgramFiles\NoMachine", "${env:ProgramFiles(x86)}\NoMachine", "$env:ProgramFiles\NX")
$nxFound = $nxPaths | Where-Object { Test-Path $_ }
if ($nxFound) { $nxFound | ForEach-Object { Write-Host "Found: $_" } } else { Write-Host "NoMachine not detected." }

Write-Host "`n=== [2] Local Redis listeners (6379/6380) and owning processes ===" -ForegroundColor Cyan
$listeners = Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue | Where-Object { $_.LocalPort -in 6379,6380 }
if ($listeners) {
  foreach ($l in $listeners) {
    $proc = Get-Process -Id $l.OwningProcess -ErrorAction SilentlyContinue
    Write-Host ("Port {0} <- PID {1} ({2}) [{3}]" -f $l.LocalPort, $l.OwningProcess, $proc.ProcessName, $proc.Path)
  }
} else { Write-Host "No Redis TCP listener found." }

Write-Host "`n=== [3] Unauthenticated PING probe ===" -ForegroundColor Cyan
foreach ($port in 6379,6380) {
  try {
    $tcp = New-Object System.Net.Sockets.TcpClient
    $tcp.Connect("127.0.0.1", $port)
    $stream = $tcp.GetStream()
    $buf = [System.Text.Encoding]::ASCII.GetBytes("PING`r`n")
    $stream.Write($buf, 0, $buf.Length)
    Start-Sleep -Milliseconds 300
    $resp = New-Object byte[] 256
    $len = $stream.Read($resp, 0, 256)
    $text = [System.Text.Encoding]::ASCII.GetString($resp, 0, $len)
    if ($text -match '\+PONG') { Write-Host "!!! Port $port: +PONG without auth — VULNERABLE configuration" -ForegroundColor Red }
    elseif ($text -match 'NOAUTH|DENIED') { Write-Host "Port $port : authentication required — OK" -ForegroundColor Green }
    $tcp.Close()
  } catch { Write-Host "Port $port : not reachable." }
}

Write-Host "`n=== [4] Redis service account context ===" -ForegroundColor Cyan
Get-CimInstance Win32_Process -Filter "Name like '%redis%'" -ErrorAction SilentlyContinue |
  ForEach-Object { $owner = Invoke-CimMethod -InputObject $_ -MethodName GetOwner
    Write-Host ("PID {0}: {1} running as {2}\{3}" -f $_.ProcessId, $_.Name, $owner.Domain, $owner.User) }