parallels vulnerabilities

Products

• parallels desktop 76
• Desktop 69
• parallels plesk panel 42
• parallels plesk small business panel 15
• remote application server 7
• parallels 5
• Parallels Desktop for Mac 5
• Access 4
• parallels access 4
• h-sphere 3
• RAS Client 3
• confixx 1
• Parallels Remote Application Server (Client) 1
• parallels small business panel 1
• parallels virtuozzo 1
• plesk 1
• virtuozzo containers 1

Latest parallels CVEs

Newest publication first · page 1 of 7

1. CVE-2026-90894 Parallels Desktop local privilege escalation via appliance extract argument injection

   Published 2026-09-14

   High·CVSS 7.8 EPSS 0.17%

   Parallels Desktop runs prl_disp_service as root. Local clients reach it on the world-writable socket /var/run/prl_disp_service.socket. PrlSrv_LoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrv_InstallAppliance lets you pick the applia...

2. CVE-2026-18263 Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability

   Published 2026-08-20

   High·CVSS 7.8 EPSS 0.17%

   Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker must first obtain the ability to execute l...

3. CVE-2026-18262 Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability

   Published 2026-08-20

   High·CVSS 7.8 EPSS 0.17%

   Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker must first obtain the ability to execute l...

4. CVE-2026-13121 Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability

   Published 2026-08-20

   High·CVSS 7.8 EPSS 0.17%

   Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker must first obtain the ability to execute l...

5. CVE-2024-52561 A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtual machine is deleted, a root service ver...

   Published 2025-06-03

   High·CVSS 7.8 EPSS 0.29%

   A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtual machine is deleted, a root service verifies and modifies the ownership of the snapshot files. By using a symlink, an a...

6. CVE-2024-54189 A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtual machine is taken, a root service write...

   Published 2025-06-03

   High·CVSS 7.8 EPSS 0.34%

   A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtual machine is taken, a root service writes to a file owned by a normal user. By using a hard link, an attacker can write...

7. CVE-2024-36486 A privilege escalation vulnerability exists in the virtual machine archive restoration functionality of Parallels Desktop for Mac version 20.1.1 (55740). When an archived virtual machine is restored,....

   Published 2025-06-03

   High·CVSS 7.8 EPSS 0.34%

   A privilege escalation vulnerability exists in the virtual machine archive restoration functionality of Parallels Desktop for Mac version 20.1.1 (55740). When an archived virtual machine is restored, the prl_vmarchiver tool decompresses the file and writes the content back to its...

8. CVE-2025-31359 A directory traversal vulnerability exists in the PVMP package unpacking functionality of Parallels Desktop for Mac version 20.2.2 (55879). This vulnerability can be exploited by an attacker to write....

   Published 2025-06-03

   High·CVSS 8.8 EPSS 0.52%

   A directory traversal vulnerability exists in the PVMP package unpacking functionality of Parallels Desktop for Mac version 20.2.2 (55879). This vulnerability can be exploited by an attacker to write to arbitrary files, potentially leading to privilege escalation.

9. CVE-2025-30074 Alludo Parallels Desktop before 19.4.2 and 20.x before 20.2.2 for macOS on Intel platforms allows privilege escalation to root via the VM creation routine.

   Published 2025-03-16

   High·CVSS 7.8 EPSS 0.12%

   Alludo Parallels Desktop before 19.4.2 and 20.x before 20.2.2 for macOS on Intel platforms allows privilege escalation to root via the VM creation routine.

10. CVE-2025-0413 Parallels Desktop Technical Data Reporter Link Following Local Privilege Escalation Vulnerability

    Published 2025-02-04

    High·CVSS 7.8 EPSS 0.41%

    Parallels Desktop Technical Data Reporter Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged...

11. CVE-2024-34331 A lack of code signature verification in Parallels Desktop for Mac v19.3.0 and below allows attackers to escalate privileges via a crafted macOS installer, because Parallels Service is setuid root.

    Published 2024-09-23

    Critical·CVSS 9.8 EPSS 1.0%

    A lack of code signature verification in Parallels Desktop for Mac v19.3.0 and below allows attackers to escalate privileges via a crafted macOS installer, because Parallels Service is setuid root.

12. CVE-2024-6240 Improper privilege management vulnerability in Parallels Desktop

    Published 2024-06-21

    Critical·CVSS 10.0 EPSS 0.32%

    Improper privilege management vulnerability in Parallels Desktop Software, which affects versions earlier than 19.3.0. An attacker could add malicious code in a script and populate the BASH_ENV environment variable with the path to the malicious script, executing on application s...

13. CVE-2024-6154 Parallels Desktop Toolgate Heap-based Buffer Overflow Local Privilege Escalation Vulnerability

    Published 2024-06-20

    Medium·CVSS 6.7 EPSS 0.25%

    Parallels Desktop Toolgate Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute high-privileged co...

14. CVE-2024-6153 Parallels Desktop Updater Protection Mechanism Failure Software Downgrade Vulnerability

    Published 2024-06-20

    High·CVSS 7.8 EPSS 0.29%

    Parallels Desktop Updater Protection Mechanism Failure Software Downgrade Vulnerability. This vulnerability allows local attackers to downgrade Parallels software on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged c...

15. CVE-2023-50228 Parallels Desktop Updater Improper Verification of Cryptographic Signature Local Privilege Escalation Vulnerability

    Published 2024-05-03

    High·CVSS 7.8 EPSS 0.21%

    Parallels Desktop Updater Improper Verification of Cryptographic Signature Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execu...

16. CVE-2023-50227 Parallels Desktop virtio-gpu Out-Of-Bounds Write Remote Code Execution Vulnerability

    Published 2024-05-03

    High·CVSS 8.3 EPSS 0.76%

    Parallels Desktop virtio-gpu Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Parallels Desktop. User interaction is required to exploit this vulnerability in that the target...

17. CVE-2023-50226 Parallels Desktop Updater Link Following Local Privilege Escalation Vulnerability

    Published 2024-05-03

    High·CVSS 7.8 EPSS 0.69%

    Parallels Desktop Updater Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the targ...

18. CVE-2023-27328 Parallels Desktop Toolgate XML Injection Local Privilege Escalation Vulnerability

    Published 2024-05-03

    High·CVSS 7.8 EPSS 0.32%

    Parallels Desktop Toolgate XML Injection Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the targ...

19. CVE-2023-27326 Parallels Desktop Toolgate Directory Traversal Local Privilege Escalation Vulnerability

    Published 2024-05-03

    High·CVSS 8.2 EPSS 1.3%

    Parallels Desktop Toolgate Directory Traversal Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute high-privileged code on t...

20. CVE-2023-27327 Parallels Desktop Toolgate Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability

    Published 2024-05-03

    High·CVSS 7.5 EPSS 0.40%

    Parallels Desktop Toolgate Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute high-privileged cod...

21. CVE-2023-27325 Parallels Desktop Updater Improper Initialization Local Privilege Escalation Vulnerability

    Published 2024-05-03

    High·CVSS 7.8 EPSS 0.36%

    Parallels Desktop Updater Improper Initialization Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on...

22. CVE-2023-27324 Parallels Desktop Updater Improper Initialization Local Privilege Escalation Vulnerability

    Published 2024-05-03

    High·CVSS 7.8 EPSS 0.37%

    Parallels Desktop Updater Improper Initialization Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on...

23. CVE-2023-27322 Parallels Desktop Service Improper Initialization Local Privilege Escalation Vulnerability

    Published 2024-05-03

    High·CVSS 7.8 EPSS 0.37%

    Parallels Desktop Service Improper Initialization Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on...

24. CVE-2023-27323 Parallels Desktop Updater Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability

    Published 2024-05-03

    High·CVSS 7.8 EPSS 0.20%

    Parallels Desktop Updater Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code...

25. CVE-2023-45894 The Remote Application Server in Parallels RAS before 19.2.23975 does not segment virtualized applications from the server, which allows a remote attacker to achieve remote code execution via standard...

    Published 2023-12-14

    Critical·CVSS 10.0 EPSS 1.2%

    The Remote Application Server in Parallels RAS before 19.2.23975 does not segment virtualized applications from the server, which allows a remote attacker to achieve remote code execution via standard kiosk breakout techniques.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.