Subscribe to GEN
Login to GEN
Add a Comment
Breaches, critical flaws, vanishing free tiers and year-long contracts have left few remote access tools worth trusting, and NoMachine is the latest to go this way. What has changed, why a resident agent is the real risk, and what to use instead: RDP, VNC and Sunshine, behind a WireGuard mesh and never on the internet.
Patrick has been with the firm since 2021.
Two remote access products with 9.8 flaws that need no login, published ten days apart. Free tiers withdrawn or rationed. Monthly prices that turn out to be a year's payment upfront.
NoMachine is the latest to go this way, and the list of remote access tools we would trust gets shorter every year.
Choosing a remote access tool used to be easy. Almost anything would do, apart from TeamViewer, whose breach history everybody knew. If one did not suit, you used it for a few months and moved on: Zoho, then GoTo, then ScreenConnect.
Today it is the other way round. By most estimates the market itself is still growing, so there is no shortage of vendors. What is shrinking is the number of options that are both safe and viable.
We set out the wider picture in our earlier article on remote access. Very few names are left that we would trust.
Free licences for personal use were a good thing. They let people try a product at home, and they gave vendors a route into a loyal user base. They are now being withdrawn or rationed.
The bigger change is that you can no longer simply move on. Moving between tools every few months has largely given way to a year at a time, paid upfront. AnyDesk's own support page says so plainly: subscriptions are billed annually with the full amount paid upfront, the displayed price is only a monthly equivalent, and you must cancel at least 30 days before renewal. TeamViewer is reported to work the same way, with annual billing, automatic renewal and 28 days' notice. NoMachine's new entry product is sold per computer, by default for a year, with one active connection at a time.
Then there is the buying process itself. Long lists of features are divided between licence tiers, and the ones you actually want tend to be in the more expensive ones. You are quoted a monthly price, and at checkout you find that you must pay annually and that there are add-ons you will also need. Mobile device support is a paid extra on TeamViewer. Zoho Assist sells remote support and unattended access as separate products with their own tiers, plus add-ons for technicians, concurrent sessions and managed devices, although to its credit it still offers monthly billing.
In our opinion this confusion is deliberate, and it is no way to build confidence in a security-critical product. It also matters for security. If a critical flaw lands in month two of a contract you have already paid for, the cheapest course is to patch and stay, whatever you now think of the vendor.
The risk underneath all of this is simple. A resident agent on a machine, connected to the internet in real time, is in effect a back door that is open 24 hours a day, waiting for the next flaw to be found. It is there whether or not anyone needs support this month, and it is there on every machine.
When that flaw arrives, the result is a panic patch of the entire estate, at whatever hour the advisory lands, and that is very expensive. CVE-2024-1709 in ScreenConnect was added to CISA's known exploited list within days, and attackers were seen trying to deploy ransomware through it. AnyDesk's CVE-2026-109390 scores 9.8, and the public exploit targets the Linux client before version 8.0.3. According to reports of the research it runs before anyone approves a session and can be reached through AnyDesk's relays as well as directly. No exploitation in the wild had been confirmed at the time of those reports, but a firewall does nothing for a relay route.
On 22 October 2026 the Zero Day Initiative published CVE-2026-114549, a heap buffer overflow in NoMachine's web service. It scores 9.8 out of 10, needs no authentication and no user interaction, and allows code to be run remotely under the service account. NoMachine lists the product as Web Player, which it builds into its Enterprise products, so not every installation is exposed. It is fixed in versions 10.1.7, 9.9.6 and 8.27.1.
One flaw would not justify leaving a product, since all complex software has them. This one, however, is the latest of nine published so far this year, out of at least 23 since 2018.
| CVE | Flaw | Attacker needs | CVSS |
|---|---|---|---|
| CVE-2026-114549 | Heap overflow in the web service, code execution | Network access only | 9.8 |
| CVE-2026-92208 | Heap overflow in mDNS parsing, code execution | Adjacent network only | 8.8 |
| CVE-2026-18264 | Command injection in the web service, code execution | A valid login | 8.8 |
| CVE-2026-92209 | Weak Redis credentials, privilege escalation | Local access | 7.8 |
| CVE-2026-5054 | Unvalidated file path, escalation to root | Local access | 7.8 |
| CVE-2026-5055 | Library search path, escalation to SYSTEM | Local access | 7.8 |
| CVE-2026-53694 | Argument injection in a script, privilege escalation | Local access | 7.3 |
| CVE-2026-92210 | Server-side request forgery in the web service | Network access only | 7.2 |
| CVE-2026-5053 | Arbitrary file deletion as root | Local access | 7.1 |
A count alone proves little, because it also reflects how closely researchers happen to be looking, and a vendor fixing what is reported is doing what it should. What matters is the kind of flaw: memory corruption reachable without a login, and repeated routes to root, in software whose whole purpose is to give someone control of a machine.
The direction is what makes it hard to forgive. The core NX technology was released under the GPL from 2003. The last open source update came in 2012, and with NoMachine 4 it became closed source, so nobody outside the company can audit the code. The free edition has now gone, and NoMachine has closed its public forum, leaving a read-only archive, on the basis that community support is no longer necessary. You may stay on version 9, which is still receiving updates for now, but the FAQ does not say for how long.
NoMachine is entitled to charge for its work. A closed product, from a vendor narrowing the ways anyone can see or discuss it, with this year's record, is simply a dependency we would no longer choose to build on. If you are leaving, we would not swap it for AnyDesk.
The better answers are mostly free, and some are already installed. RDP and VNC services also run all the time, so being resident is not the whole objection. The difference is whether the internet can reach them. Every one of these stays behind a WireGuard mesh or, for a few machines, a single point-to-point tunnel, and none of them is ever exposed to the internet.
None of these protocols is strong enough to stand alone. RDP in particular is weak. BlueKeep scored the same 9.8 in 2019, needed no login, and could spread between machines without help. Sophos reported RDP being abused in 90% of the incident response cases it handled in 2023, with external remote services the way in for 65% of them. It is closed source too, so our objection to NoMachine's closed code applies here as well. The difference is that RDP arrives with the operating system and is patched with it, so it adds no new supplier to trust and no separate update to forget.
Over a WireGuard mesh, a scanner finds nothing to probe, and an attacker needs a WireGuard key before ever reaching the login. Our July article listed NoMachine alongside RDP and VNC as something to run inside the tunnel. The mesh advice stands, but we would no longer include NoMachine.
Some machines will never be on your mesh, such as a client's laptop or a home PC that needs help just once. If you must have an internet-facing tool for those, choose one that is only there while it is being used. Splashtop deserves some credit here, and Splashtop SOS is the tool we use ourselves.
On Windows and Mac there is no installer. The person needing help runs a small program and reads out a session code, and the session ends when the program is closed. The file may sit in Downloads until someone deletes it, but nothing stays running, and nobody can connect again unless the user runs it and gives out a new code. That leaves nothing resident to forget, to patch or to expose, which in our view gives it an excellent security profile. Splashtop also has no publicly known breach of its remote support systems.
It is not perfect, and we would not pretend otherwise. SOS is a hosted service, so the vendor is in the chain during a session. Splashtop's resident Streamer agent has had CVEs of its own, mostly local privilege escalation, and SOS is priced per month and billed annually, like the others. A tool that is present only when someone asks for help is still a far smaller target than one that never leaves.
If you would rather not build and run the mesh yourself, GENAccess is our fully managed WireGuard service, and it exists for exactly this.
This article reflects publicly reported information at the time of writing, 3 November 2026, together with our own opinions. CVE counts come from public trackers and may be incomplete, scores are as published and may be revised, and product terms and prices change, so please check the current position with each vendor. GEN is a customer of Splashtop and has no other commercial affiliation with the vendors named.
This content is not legal or financial advice, and is solely the opinion of the author.