CVE WatchAug 21, 2026

CVE-2026-13121

Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows loca

CVSS

7.8

High

EPSS

0.1%

KEV

—

Exploit Today

0-100

Published: Aug 20, 2026 · Last modified: Aug 21, 2026 · CWE-749

EPSS · 30d

0.1%EPSS · 30 days0.2%

2026-08-212026-08-30

Technical description

Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the RAS RDP Backend Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-29220.

Official references

www.zerodayinitiative.comhttps://www.zerodayinitiative.com/advisories/ZDI-26-554/

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-182637.8 HIG

3.1%

——1Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the RAS RDP Backend Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-28886.4d CVE-2026-182627.8 HIG

2.9%

23.4%

——7Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-external IPC handler in src/ipc/downloads.js passes a renderer-supplied url directly to Electron's shell.openExternal without validating its protocol. A compromised renderer can submit file: URIs or operating-system-specific custom schemes, causing the host to open local files, access remote resources through registered handlers, or launch scripts and applications supported by those handlers. This issue is fixed in version 2.6.0.11d CVE-2026-4805610.0 CRI

30.9%

——9Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 improperly validate executable paths supplied to the run-download IPC handler, allowing a compromised renderer process to execute arbitrary local binaries with the application’s privileges. Version 2.5.0 contains a patch.19d CVE-2026-688239.1 CRI

46.5%

——14Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute code over a network.23d CVE-2026-189017.2 HIG

37.7%

——11A security vulnerability has been detected in H3C NX15 V100R017. Affected is the function service.add of the file /api/esps of the component Web API. Such manipulation leads to exposed dangerous routine. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.18d