Parallels vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-90894 Parallels Desktop runs prl_disp_service as root.High 7.8 · Sep 14, 2026
• CVE-2026-18263 Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability.High 7.8 · Aug 20, 2026
• CVE-2026-18262 Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability.High 7.8 · Aug 20, 2026
• CVE-2026-13121 Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability.High 7.8 · Aug 20, 2026
• CVE-2025-31359 A directory traversal vulnerability exists in the PVMP package unpacking functionality of Parallels Desktop for Mac version 20.2.2 (55879).High 8.8 · Jun 3, 2025
• CVE-2024-54189 A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740).High 7.8 · Jun 3, 2025
• CVE-2024-52561 A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740).High 7.8 · Jun 3, 2025
• CVE-2024-36486 A privilege escalation vulnerability exists in the virtual machine archive restoration functionality of Parallels Desktop for Mac version 20.1.1 (55740).High 7.8 · Jun 3, 2025
• CVE-2025-30074 Alludo Parallels Desktop before 19.4.2 and 20.x before 20.2.2 for macOS on Intel platforms allows privilege escalation to root via the VM creation routine.High 7.8 · Mar 15, 2025
• CVE-2025-0413 Parallels Desktop Technical Data Reporter Link Following Local Privilege Escalation Vulnerability.High 7.8 · Feb 4, 2025
• CVE-2024-34331 A lack of code signature verification in Parallels Desktop for Mac v19.3.0 and below allows attackers to escalate privileges via a crafted macOS installer, becaCritical 9.8 · Sep 23, 2024
• CVE-2024-6240 Improper privilege management vulnerability in Parallels Desktop Software, which affects versions earlier than 19.3.0.High 7.7 · Jun 21, 2024
• CVE-2024-6153 Parallels Desktop Updater Protection Mechanism Failure Software Downgrade Vulnerability.High 7.8 · Jun 20, 2024
• CVE-2023-50228 Parallels Desktop Updater Improper Verification of Cryptographic Signature Local Privilege Escalation Vulnerability.High 7.8 · May 2, 2024
• CVE-2023-50227 Parallels Desktop virtio-gpu Out-Of-Bounds Write Remote Code Execution Vulnerability.High 8.3 · May 2, 2024
• CVE-2023-50226 Parallels Desktop Updater Link Following Local Privilege Escalation Vulnerability.High 7.8 · May 2, 2024
• CVE-2023-27328 Parallels Desktop Toolgate XML Injection Local Privilege Escalation Vulnerability.High 7.8 · May 2, 2024
• CVE-2023-27327 Parallels Desktop Toolgate Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability.High 7.5 · May 2, 2024
• CVE-2023-27326 Parallels Desktop Toolgate Directory Traversal Local Privilege Escalation Vulnerability.High 8.2 · May 2, 2024
• CVE-2023-27325 Parallels Desktop Updater Improper Initialization Local Privilege Escalation Vulnerability.High 7.8 · May 2, 2024
• CVE-2023-27324 Parallels Desktop Updater Improper Initialization Local Privilege Escalation Vulnerability.High 7.8 · May 2, 2024
• CVE-2023-27323 Parallels Desktop Updater Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability.High 7.8 · May 2, 2024
• CVE-2023-27322 Parallels Desktop Service Improper Initialization Local Privilege Escalation Vulnerability.High 7.8 · May 2, 2024
• CVE-2023-45894 The Remote Application Server in Parallels RAS before 19.2.23975 does not segment virtualized applications from the server, which allows a remote attacker to acCritical 10 · Dec 14, 2023
• CVE-2022-40870 The Web Client of Parallels Remote Application Server v18.0 is vulnerable to Host Header Injection attacks.High 8.1 · Nov 22, 2022