Parallels RAS Client CVE-2026-18263

Exploitation requires the attacker to already hold low-privileged code execution on the target system, as confirmed by CVSS PR:L - remote unauthenticated exploitation is not possible (AV:L). Parallels RAS Client version 21.0.26296 must be installed and the RAS RDP Backend Service must be actively running. No user interaction beyond the attacker's own code execution is required (UI:N). The attack surface is limited to Windows endpoints in environments that have deployed Parallels RAS Client, typically enterprise VDI or remote application delivery deployments. The primary limiting factor is the requirement for a prior local foothold; without user-level access or a secondary vulnerability providing code execution, remote exploitation is not achievable.

The CVSS 3.0 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.8 High, accurately reflecting the low bar to exploitation (any authenticated local user or process) and full CIA impact at SYSTEM privilege. Attack complexity is Low, meaning no race conditions or special timing are required. KEV status is not confirmed and no EPSS data was provided, keeping estimated widespread exploitation pressure lower than the headline score implies. However, local privilege escalation to SYSTEM is a high-value post-exploitation capability, particularly in enterprise VDI and remote application delivery environments where Parallels RAS Client is typically deployed alongside many concurrent low-privileged user sessions. A compromised or malicious insider, or malware that has already achieved user-level access, could leverage this to fully own the endpoint. The absence of a confirmed patch version in available data represents a meaningful operational gap that defenders should resolve with Parallels directly.

A standard domain user on a VDI endpoint running Parallels RAS Client 21.0.26296 executes a crafted binary or script that locates and invokes the exposed dangerous function exposed by the RAS RDP Backend Service over its local IPC interface. Because the service runs as SYSTEM and performs no caller access control on that function, the attacker's code executes with SYSTEM privileges, enabling full credential harvesting, persistence installation, or lateral movement. No public POC has been identified at time of analysis, but ZDI's coordinated disclosure framework typically precedes community POC release by a short interval.