Parsec CVE-2026-25039

Exploitation requires the attacker to be an authenticated member of a shared Parsec organization with the ability to create or name a workspace (CVSS PR:L), and requires that the malicious workspace name be permitted to contain the backslash character so it resolves to a UNC path such as \\host\share. Impact is realized only on the Windows client platform, where workspace names are used to build filesystem mountpoints; non-Windows clients are not described as affected. NTLM hash disclosure occurs when a victim's Windows client mounts the poisoned workspace and reaches an attacker-controlled SMB host, while an invalid/unreachable UNC target instead causes denial of service (client becomes unresponsive). Limiting factors: requires org membership, a Windows victim, and outbound SMB reachability to the attacker's server, all of which reduce the population of exploitable deployments below what the network-vector CVSS alone implies.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H, score 8.8) marks this as high severity: network reachable, low complexity, requiring only low privileges (PR:L, i.e. authenticated org membership) and no user interaction. There is no EPSS score, no KEV listing, and no POC reference in the provided data, so this is a high-CVSS issue without evidence of active or automated exploitation - meaning real-world urgency is driven by the credential-theft impact rather than mass exploitation. One caveat: the vendor rating of I:H (integrity high) is arguable, since the directly described impacts are credential disclosure (confidentiality) and application hang (availability); integrity impact is indirect, realized only if the stolen NetNTLM hash is subsequently cracked or relayed. Because exploitation requires being an existing member of a shared organization who can create/name a workspace, the realistic threat is an insider or a compromised collaborator rather than an anonymous internet attacker.

An attacker who is a member of a Parsec organization creates or renames a workspace to a UNC path pointing at their SMB server, e.g. \\attacker.example\share. When other members' Windows Parsec clients mount that workspace, Windows automatically authenticates to the attacker's host and leaks each victim's NetNTLM hash for offline cracking or relay; alternatively the attacker points the name at an invalid host to freeze victims' clients. No public POC is currently identified, but the technique mirrors well-known UNC/NTLM-leak attacks.