CVE WatchJul 6, 2026

CVE-2026-54424

An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hosts leads to a potential Elevation of Privilege. This issue a

CVSS

8.4

High

EPSS

0.2%

p16

KEV

—

Exploit Today

0-100

Published: Jul 4, 2026 · Last modified: Jul 6, 2026 · CWE-648

EPSS · 30d

0.2%EPSS · 30 days0.2%

2026-07-042026-07-19

Technical description

An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hosts leads to a potential Elevation of Privilege. This issue affects Parsec through v2026-05-04.0. The patched version is Parsec for Windows version 150-104a. A user can generate a situation where there is an instance of parsecd.exe running as NT AUTHORITY\SYSTEM with a user-controlled value of the AppData environment variable.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2025-545027.5 HIG

4.2%

——1Incorrect use of boot service in the AMD Platform Configuration Blob (APCB) SMM driver could allow a privileged attacker with local access (Ring 0) to achieve privilege escalation potentially resulting in arbitrary code execution.5d