EUVD-2026-63464
GHSA-vpmj-2529-7w95
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only attack vector with low-privilege requirement; full CIA impact justified as attacker achieves SYSTEM execution; no scope change since exploitation remains within the same security context.
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
Lifecycle Timeline
2DescriptionCVE.org
Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the RAS RDP Backend Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-28886.
AnalysisAI
Local privilege escalation in Parallels RAS Client 21.0.26296 allows an attacker holding low-privileged code execution to reach SYSTEM-level authority by invoking an exposed dangerous function in the RAS RDP Backend Service (CWE-749). The CVSS 7.8 (High) rating reflects full confidentiality, integrity, and availability impact once exploited, with low attack complexity and no user interaction required beyond an initial foothold. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already hold low-privileged code execution on the target system, as confirmed by CVSS PR:L - remote unauthenticated exploitation is not possible (AV:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.0 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.8 High, accurately reflecting the low bar to exploitation (any authenticated local user or process) and full CIA impact at SYSTEM privilege. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version has been independently confirmed in the available data; organizations should consult Parallels' official security channel and the ZDI advisory at https://www.zerodayinitiative.com/advisories/ZDI-26-556/ to obtain the authoritative fix version and apply it immediately upon release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running Parallels RAS Client 21.0.26296 and assess criticality of affected assets. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ras Client
View allLocal privilege escalation in Parallels RAS Client 21.0.26296 allows low-privileged local attackers to gain SYSTEM-level
Local privilege escalation in Parallels RAS Client 21.0.26296 allows a low-privileged local attacker to escalate to SYST
Same weakness CWE-749 – Exposed Dangerous Method or Function
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today