Parallels RAS Client CVE-2026-13121

The attacker must first have the ability to execute low-privileged code on the target system - this is an explicit prerequisite stated in the vulnerability description. The vulnerable component is the RAS RDP Backend Service, meaning the service must be running (i.e., Parallels RAS Client must be installed and the backend service active). Exploitation does not require administrator or elevated privileges - standard user-level access is sufficient. No user interaction or network access is required beyond initial local code execution. Exploitation is limited to systems where Parallels RAS Client 21.0.26296 is installed and where the RAS RDP Backend Service is running; systems not running this specific client software are unaffected.

The CVSS 3.0 base score of 7.8 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects the local-only, low-complexity nature of the exploit - the attacker must already have a foothold on the target system. There is no EPSS data available, and the vulnerability is not listed in CISA KEV, suggesting it is not yet confirmed in active exploitation campaigns. The real-world priority is moderate: organizations running Parallels RAS Client in multi-user or shared endpoint environments (e.g., VDI kiosks, shared workstations, RDS farms) face elevated risk because low-privileged user accounts are frequently available to multiple parties in such deployments. In single-user workstation deployments the risk is reduced, as physical or remote access is already required. The absence of a public POC and KEV listing keeps urgency below critical, but ZDI publication typically signals that a coordinated patch process has occurred.

A low-privileged user authenticated to a shared VDI host running Parallels RAS Client 21.0.26296 identifies the exposed dangerous function in the RAS RDP Backend Service - likely via a local IPC interface - and invokes it with crafted parameters to trigger privileged code execution. The service, running as SYSTEM, executes the attacker-supplied code, granting the attacker full control of the host. No public POC has been identified, but ZDI coordination implies the attack path has been technically validated.