EUVD-2026-63464
GHSA-vpmj-2529-7w95
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only attack vector with low-privilege requirement; full CIA impact justified as attacker achieves SYSTEM execution; no scope change since exploitation remains within the same security context.
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
Lifecycle Timeline
2DescriptionCVE.org
Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the RAS RDP Backend Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-28886.
AnalysisAI
Local privilege escalation in Parallels RAS Client 21.0.26296 allows an attacker holding low-privileged code execution to reach SYSTEM-level authority by invoking an exposed dangerous function in the RAS RDP Backend Service (CWE-749). The CVSS 7.8 (High) rating reflects full confidentiality, integrity, and availability impact once exploited, with low attack complexity and no user interaction required beyond an initial foothold. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already hold low-privileged code execution on the target system, as confirmed by CVSS PR:L - remote unauthenticated exploitation is not possible (AV:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.0 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.8 High, accurately reflecting the low bar to exploitation (any authenticated local user or process) and full CIA impact at SYSTEM privilege. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version has been independently confirmed in the available data; organizations should consult Parallels' official security channel and the ZDI advisory at https://www.zerodayinitiative.com/advisories/ZDI-26-556/ to obtain the authoritative fix version and apply it immediately upon release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running Parallels RAS Client 21.0.26296 and assess criticality of affected assets. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The default configuration of Parallels Plesk Panel 9.0.x and 9.2.x on UNIX, and Small Business Panel 10.x on UNIX, has a
Parallels Remote Application Server (RAS) 17.1.1 has a Business Logic Error causing remote code execution. Rated critica
Directory traversal vulnerability in Parallels Desktop for Mac version 20.2.2 (build 55879) affecting the PVMP package u
The Web Client of Parallels Remote Application Server v18.0 is vulnerable to Host Header Injection attacks. Rated high s
Privilege escalation vulnerability in Parallels Desktop for Mac version 20.1.1 (build 55740) where the snapshot function
Privilege escalation vulnerability in Parallels Desktop for Mac 20.1.1 that allows a local attacker with user-level priv
Privilege escalation vulnerability in Parallels Desktop for Mac version 20.1.1 (build 55740) affecting the Snapshot dele
SQL injection vulnerability in admin/plib/api-rpc/Agent.php in Parallels Plesk Panel 7.x and 8.x before 8.6 MU#2, 9.x be
Parallels 13 uses cleartext HTTP as part of the update process, allowing man-in-the-middle attacks. Rated high severity
Multiple cross-site request forgery (CSRF) vulnerabilities in Parallels H-Sphere 3.3 Patch 1 allow remote attackers to h
Parallels H-Sphere 3.6.1713 allows XSS via the index_en.php from parameter. Rated medium severity (CVSS 6.1), this vulne
Parallels Plesk Panel 9.5 allows XSS in target/locales/tr-TR/help/index.htm? via the "fileName" parameter. Rated medium
Same weakness CWE-749 – Exposed Dangerous Method or Function
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today