CVE-2026-18263
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Vulnerability in Parallels RAS Client in the RDP Backend Service is due to an exposed dangerous function. A local attacker can exploit this flaw to escalate privileges and execute arbitrary code in the context of SYSTEM.
Risk Assessment
The risk for the organization is the possibility of privilege escalation by a local user, potentially leading to full system compromise.
Recommendation
It is recommended to update Parallels RAS Client to the latest version and restrict local access to the system to trusted users only.
Other vulnerabilities in Parallels RAS Client
See all- CVE-2026-18262High
Vulnerability in Parallels RAS Client in the RDP Backend Service is due to an exposed dangerous function. A local attacker can exploit this flaw to escalate privileges and execute arbitrary code in the context of SYSTEM.
- CVE-2026-13121High
Vulnerability in Parallels RAS Client in the RDP Backend Service is due to an exposed dangerous function. A local attacker can exploit this flaw to escalate privileges and execute arbitrary code in the context of SYSTEM.
Original NVD description (English source)
Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the RAS RDP Backend Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-28886.