# CVE-2026-18263: Parallels RAS Client privilege escalation in RDP Backend Service

Source: https://junglewise.ai/threats/cve-2026-18263-parallels-ras-client-privilege-escalation-in-rdp-backend-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-18263 · Severity: high · CVSS 7.8 · Published 2026-08-20

Parallels RAS Client is a remote access solution that enables users to connect to systems remotely via RDP. A local privilege escalation vulnerability in the RDP Backend Service allows an attacker with low-privileged code execution to gain SYSTEM-level privileges, potentially compromising the entire system and enabling lateral movement within a network.

Technologies: [Parallels RAS Client](https://junglewise.ai/threats/technologies/ras-client). Vendors: [Parallels](https://junglewise.ai/threats/vendors/parallels).

## Quick answers

**Is CVE-2026-18263 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18263 being exploited in the wild.

**How severe is CVE-2026-18263?** High severity, with a CVSS score of 7.8, published 20 August 2026.

**Which products and versions are affected?** Parallels RAS Client.

**Is there a fix for CVE-2026-18263?** A patch was published on 2026-08-11: Fixed in RAS Client version 21.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-18263 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-18263?** Check whether you run Parallels RAS Client. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability exists in the Parallels RAS Client RDP Backend Service, where an exposed dangerous function can be leveraged for privilege escalation. The flaw requires local code execution as a prerequisite; an attacker must already have the ability to run low-privileged code on the target system. By exploiting this exposed function, an attacker can escalate privileges to the SYSTEM context and execute arbitrary code with the highest privileges. The issue was fixed in RAS Client version 21.2 and has been assigned CVE-2026-18263 (CVSS 7.8).

## Affected products

- Parallels RAS Client

## Timeline

- 2026-02-25: disclosed: Vulnerability reported to vendor
- 2026-08-11: patched: Fixed in RAS Client version 21.2
- 2026-08-11: advisory: Coordinated public disclosure as ZDI-26-556

## References

- [https://www.zerodayinitiative.com/advisories/ZDI-26-556/](https://www.zerodayinitiative.com/advisories/ZDI-26-556/)

## Related threats

- [Parallels RAS Client privilege escalation in RDP Backend Service](https://junglewise.ai/threats/cve-2026-18262-parallels-ras-client-privilege-escalation-in-rdp-backend-service)
- [Parallels RAS Client privilege escalation in RDP Backend Service](https://junglewise.ai/threats/cve-2026-13121-parallels-ras-client-privilege-escalation-in-rdp-backend-service)