ZDI-26-554: Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability

ZDI-disclosed vulnerability (ZDI-CAN-29220) in the RAS RDP Backend Service of the Parallels RAS Client exposes a dangerous function (CWE-749), allowing a local attacker to escalate privileges. To trigger it, an attacker must already be able to execute low-privileged code on the target machine, after which the exposed function of the service can be abused to run arbitrary code. Successful exploitation yields code execution in the context of SYSTEM, the highest local privilege on Windows, giving the attacker full control of the host. Organizations running the Parallels Remote Application Server (RAS) Client component are affected. As of disclosure, there is no known public proof-of-concept, EPSS is 0.1%, and the flaw is not in the CISA KEV catalog, indicating no confirmed exploitation in the wild.

Do: Apply the patched Parallels RAS Client build referenced in ZDI-26-554 and Parallels' advisory (specific fixed version numbers are not included in the available disclosure data). Inventory endpoints where the RAS RDP Backend Service is installed and running as SYSTEM, and prioritize hosts where low-privileged or untrusted users can execute code. Until patched, restrict local code execution on RAS client hosts and monitor the service for anomalous child-process or privilege activity.