EUVD-2026-63461
GHSA-q7c4-rqx8-mr8v
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local attack vector with low-privilege prerequisite confirmed by description; no scope change as impact is contained to the compromised host at SYSTEM level.
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
Lifecycle Timeline
2DescriptionCVE.org
Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the RAS RDP Backend Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-29220.
AnalysisAI
Local privilege escalation in Parallels RAS Client 21.0.26296 allows a low-privileged local attacker to escalate to SYSTEM-level execution by invoking an exposed dangerous function within the RAS RDP Backend Service. The flaw (CWE-749) stems from the service exposing an unsafe method that can be abused without administrative rights, enabling full system compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must first have the ability to execute low-privileged code on the target system - this is an explicit prerequisite stated in the vulnerability description. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.0 base score of 7.8 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects the local-only, low-complexity nature of the exploit - the attacker must already have a foothold on the target system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the ZDI advisory at https://www.zerodayinitiative.com/advisories/ZDI-26-554/ and the Parallels vendor channel for an official patched release; no exact fix version has been confirmed in the available intelligence data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify and inventory all systems running Parallels RAS Client 21.0.26296 across your environment; audit local user access and review authentication logs for signs of privilege escalation attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The default configuration of Parallels Plesk Panel 9.0.x and 9.2.x on UNIX, and Small Business Panel 10.x on UNIX, has a
Parallels Remote Application Server (RAS) 17.1.1 has a Business Logic Error causing remote code execution. Rated critica
Directory traversal vulnerability in Parallels Desktop for Mac version 20.2.2 (build 55879) affecting the PVMP package u
The Web Client of Parallels Remote Application Server v18.0 is vulnerable to Host Header Injection attacks. Rated high s
Privilege escalation vulnerability in Parallels Desktop for Mac version 20.1.1 (build 55740) where the snapshot function
Privilege escalation vulnerability in Parallels Desktop for Mac 20.1.1 that allows a local attacker with user-level priv
Privilege escalation vulnerability in Parallels Desktop for Mac version 20.1.1 (build 55740) affecting the Snapshot dele
SQL injection vulnerability in admin/plib/api-rpc/Agent.php in Parallels Plesk Panel 7.x and 8.x before 8.6 MU#2, 9.x be
Parallels 13 uses cleartext HTTP as part of the update process, allowing man-in-the-middle attacks. Rated high severity
Multiple cross-site request forgery (CSRF) vulnerabilities in Parallels H-Sphere 3.3 Patch 1 allow remote attackers to h
Parallels H-Sphere 3.6.1713 allows XSS via the index_en.php from parameter. Rated medium severity (CVSS 6.1), this vulne
Parallels Plesk Panel 9.5 allows XSS in target/locales/tr-TR/help/index.htm? via the "fileName" parameter. Rated medium
Same weakness CWE-749 – Exposed Dangerous Method or Function
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today