CVE-2026-13121

Executive Summary

CVE-2026-13121 is a locally exploitable privilege escalation vulnerability in the Parallels RAS Client, specifically within the RAS RDP Backend Service. The flaw stems from an exposed dangerous function that allows a low-privileged local attacker to escalate privileges to SYSTEM and execute arbitrary code. The vulnerability carries a CVSS score of 7.8 (High) with a vector of CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating low attack complexity and no user interaction required. As of this writing, the vulnerability remains unpatched (patch confidence 0/4), and no public exploit code or proof-of-concept has been identified. Organizations using Parallels RAS Client should treat this as an imminent risk and implement compensating controls.

Technical Analysis

The vulnerability is categorized under CWE-749: Exposed Dangerous Method or Function. According to the NVD description, the specific flaw exists within the "RAS RDP Backend Service," a component of the Parallels RAS Client responsible for handling Remote Desktop Protocol (RDP) backend communications. The root cause is that the service exposes a dangerous function—likely an internal API or method with elevated privileges—to local callers without adequate access control or input validation.

From a vulnerability-class perspective, CWE-749 typically arises when a privileged service exposes an entry point (e.g., a named pipe, local COM object, or inter-process communication endpoint) that can be invoked by unprivileged processes. The exposed function performs a security-sensitive operation—in this case, likely spawning processes, writing to protected file locations, or modifying system configuration—under the security context of the service (SYSTEM). An attacker who can execute low-privileged code on the target system can directly invoke this exposed function, bypassing standard security checks.

The attack surface is entirely local: the attacker must first establish a foothold on the target system (e.g., via a standard user account, a compromised application, or a downloaded payload). No network component is involved in the exploitation of the vulnerability itself; the CVSS vector confirms this with AV:L (Local) and PR:L (Low privileges required). The lack of a UI:R flag indicates no user interaction is needed—the attack can be fully automated once initial code execution is achieved.

The NVD description does not provide specific function names, endpoint identifiers, or process names beyond "RAS RDP Backend Service." The exact mechanics—whether the dangerous function is reachable via a named pipe, a local TCP port, a Windows service control manager interface, or a shared memory region—are not documented in the available data. Given the "Parallels RAS" context, it is plausible the service exposes a local communication channel used by client components, and insufficient access controls allow low-privilege callers to invoke privileged operations. However, this is inference; the report must note that insufficient technical detail is available to confirm the precise interface.

The CNA designation references "ZDI-CAN-29220," indicating the vulnerability was originally reported through the Zero Day Initiative (ZDI) program. This suggests the issue was discovered by a security researcher and responsibly disclosed to both ZDI and Parallels. The absence of a patch despite ZDI coordination implies the vendor has not yet released a fix, leaving affected installations exposed.

Exploitation Scenarios

No public PoC exists at the time of writing; the attack chain below is inferred from the vulnerability class and the CVSS vector, and should be treated as a technical assessment of plausible exploitation paths.

Step 1: Reconnaissance / Target Identification An attacker with local access—either through a legitimate low-privileged user account, a previously compromised process, or a downloaded malicious binary—scans the target for the presence of the Parallels RAS Client. This can be done by enumerating installed programs (e.g., wmic product), checking running services, or listing processes for the "RAS RDP Backend Service" process name. The attacker also enumerates the local inter-process communication endpoints exposed by the service to identify the dangerous function documented in the ZDI advisory.

Step 2: Triggering the Flaw The attacker invokes the exposed dangerous function from a low-privileged context. Based on the CWE-749 classification, the service fails to enforce access control on the function call, allowing an unprivileged caller to request an operation that should require administrative privileges. The call is made via whatever local interface the service exposes (e.g., a named pipe, local RPC endpoint, or COM interface), though the specific interface name is not available from the disclosure data.

Step 3: Payload / Execution Method The dangerous function likely executes an operation on behalf of the caller—such as creating a process, writing to a restricted file path, or modifying a service configuration—that runs under the SYSTEM account. If the function accepts arguments that include a command line or file path, the attacker supplies a malicious payload (e.g., a reverse shell, a new local administrator account creation command, or a backdoor binary). The service, running as SYSTEM, executes the payload with elevated privileges, granting the attacker code execution in the SYSTEM context.

Step 4: Post-Exploitation Impact With SYSTEM-level access, the attacker gains full control of the host: they can disable security products, install persistent backdoors, exfiltrate sensitive data (including credentials, domain trust material, and other users' files), and pivot laterally to other systems on the network. On domain-joined machines, SYSTEM access often translates to the computer account, which can be leveraged for further lateral movement (e.g., via Kerberoasting or Pass-the-Ticket techniques).

No evidence exists of active in-the-wild exploitation or threat actor campaigns referencing this CVE. The vulnerability is not listed on the CISA KEV catalog.

Impact Assessment

The CVSS score of 7.8 (High) reflects a serious local privilege escalation with complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H on the affected host). The attack complexity is low, privileges required are minimal (PR:L), and no user interaction is needed, making exploitation straightforward once a foothold is established.

Affected Systems: Any host running the Parallels RAS Client—commonly deployed in enterprise environments where Parallels RAS serves as the remote access gateway for virtual desktops and applications. The vulnerability impacts the client endpoint, meaning it affects employee workstations and any other machines where the client is installed.

Blast Radius: While the vulnerability itself is local, the systemic consequences are amplified in enterprise contexts. A compromised endpoint with SYSTEM privileges can serve as a beachhead for lateral movement into the broader network, potentially exposing backend infrastructure connected to the Parallels RAS environment (e.g., RDP hosts, virtual desktop pools, application servers). In a scenario where the RAS Client is deployed on a jump host or administrative workstation, the blast radius broadens to include privileged access to remote sessions managed through Parallels RAS.

Business Impact: Failure to remediate can lead to data breaches, ransomware deployment, regulatory fines (GDPR, HIPAA, PCI-DSS), and reputational damage. Because the vulnerability is unpatched, affected organizations currently have no vendor-supplied fix, elevating the urgency for compensating controls.

Detection Guidance

The following detection artifacts are generated based on the vulnerability class (CWE-749) and the local privilege escalation pattern. Since the precise interface name is unknown, these rules focus on observable behaviors: unexpected local calls to the service, anomalous process creation from the service, and privilege escalation events. All rules assume Windows endpoints are in scope.

Sigma Rule

title: Parallels RAS RDP Backend Service Privilege Escalation Attempt
id: 2c8f6a51-9b3e-4c8d-b1a7-6f93d0e5c2a4
status: experimental
description: Detects suspicious process creation from the Parallels RAS RDP Backend Service, potentially indicating invocation of the exposed dangerous function (CVE-2026-13121).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-13121
tags:
    - attack.privilege_escalation
    - attack.t1068
    - cve.2026-13121
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\rasrdpbackendsvc.exe'  # inferred name—adjust to actual service binary
    condition: selection
level: high
falsepositives:
    - Legitimate RAS Client operations that spawn child processes for RDP connections

YARA Rule

rule CVE_2026_13121_Parallels_RAS_Backend
{
    meta:
        author = "Valters IT Threat Intel"
        description = "Detects files or memory artifacts containing indicators of the Parallels RAS RDP Backend Service (CVE-2026-13121)"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-13121"
    strings:
        $s1 = "RAS RDP Backend" ascii wide nocase
        $s2 = "rasrdpbackend" ascii wide nocase
        $s3 = "ZDI-CAN-29220" ascii wide nocase
    condition:
        any of them
}

Suricata IDS Rule

# Note: This vulnerability is local (AV:L) and does not generate network traffic during exploitation.
# The following rule is a fallback to detect any network activity originating from the RAS client
# that may indicate post-exploitation command-and-control or lateral movement.
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-13121 - Potential Post-Exploitation C2 from Parallels RAS Client"; flow:to_server,established; content:"/cmd"; nocase; sid:202613121; rev:1;)

Elastic Detection

// Detect suspicious child processes spawned by the RAS Backend Service
process where event.action == "start" and
  process.parent.name == "rasrdpbackendsvc.exe" and
  (not process.name in ("mstsc.exe", "rundll32.exe"))

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security
| search EventCode=4688
| where ParentImage LIKE "%rasrdpbackendsvc.exe%"
| eval suspicious = if(match(NewProcessName, "(?i)(cmd|powershell|wscript|cscript|regsvr32|mshta)"), "High", "Review")
| table _time, ParentImage, NewProcessName, CommandLine, User, suspicious
| where suspicious="High"

Wazuh OSSEC Rule

<group name="syscheck, rootcheck,">
    <rule id="100213" level="10">
        <if_sid>550</if_sid>
        <field name="win.event.system.eventID">1</field>
        <field name="win.eventdata.parentImage">\\rasrdpbackendsvc.exe$</field>
        <field name="win.eventdata.commandLine">(?i)(cmd|powershell|wscript|cscript|regsvr32|mshta)</field>
        <description>CVE-2026-13121: Suspected privilege escalation via Parallels RAS RDP Backend Service</description>
        <mitre>
            <id>T1068</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Status: The vendor has not released a patch as of the publication date. Patch confidence is 0/4 across all tracked sources, and no workarounds have been provided by Parallels or the ZDI.

1. Immediate Mitigations:

• Restrict local access: Limit interactive logon to affected endpoints to trusted users only, minimizing the pool of potential local attackers.
• Application allowlisting: Use AppLocker or Windows Defender Application Control (WDAC) to block unauthorized executables from running on endpoints with the RAS Client installed.
• Monitor for suspicious local calls: Implement the Sigma/Elastic/Splunk detection rules above to alert on abnormal process creation from the RAS Backend Service.
• Disable the service if feasible: If the RAS RDP Backend Service is not essential for the organization's remote access workflow, temporarily disable it via the Services MMC or sc config command. Validate functionality before deployment.

2. Patch/Upgrade Steps:

• Monitor the Parallels security advisories page and the ZDI advisory portal for firmware or software updates addressing ZDI-CAN-29220.
• When a patch is released, apply it to all endpoints running the RAS Client using a centralized patch management solution (e.g., Microsoft Endpoint Manager, Tanium, or Ivanti). Prioritize high-value systems (domain controllers, jump hosts, admin workstations) for emergency patching outside the normal cycle.

3. Long-Term Hardening:

• Least privilege principle: Ensure that end-user accounts have minimal local permissions, reducing the chance of achieving the prerequisite low-privileged code execution.
• Endpoint Detection and Response (EDR): Deploy or maintain an EDR solution with behavioral detection that flags privilege escalation patterns (e.g., unexpected SYSTEM-level process spawns from known services).
• Network segmentation: Ensure that endpoints running the RAS Client are segregated from sensitive backend networks, limiting lateral movement in the event of a successful compromise.
• Security baseline review: Periodically audit local services and their exposed interfaces, particularly vendor software like Parallels, to identify exposed dangerous functions proactively.

References

1. NVD Entry for CVE-2026-13121 — Official CVE NIST record confirming the CWE-749 classification and CVSS vector.
2. Zero Day Initiative (ZDI) Advisory ZDI-CAN-29220 — Original researcher report reference; the advisory ID is cited in the official description.
3. Parallels Security Advisories — Vendor security page to monitor for forthcoming patches.
4. CISA Known Exploited Vulnerabilities Catalog — CVE-2026-13121 is not listed, confirming no known in-the-wild exploitation as of the report date.
5. CWE-749: Exposed Dangerous Method or Function — MITRE weakness reference for the vulnerability class, providing context on the flaw mechanism and potential attack patterns.