CVE-2026-54424

Executive Summary

CVE-2026-54424 is a high-severity Elevation of Privilege vulnerability (CVSS 8.4) in Unity Parsec for Windows, affecting all releases through v2026-05-04.0. The flaw allows a low-privileged local user to abuse an incorrect use of privileged APIs, resulting in an instance of parsecd.exe running as NT AUTHORITY\SYSTEM with a user-controlled value for the AppData environment variable. Successful exploitation grants complete SYSTEM-level code execution in the context of the Parsec service, with the vendor fixing the issue in Parsec for Windows version 150-104a (though patch monitoring confidence remains low, indicating organizations should manually verify deployment).

Technical Analysis

The vulnerability resides in the way the Parsec Windows client's core service (parsecd.exe) initializes and manages its environment prior to spawning worker processes or performing privileged operations. The application incorrectly uses Windows APIs that are reserved for privileged contexts — specifically, it permits a child process or a user-controlled environment variable (AppData) to influence where the service reads configuration files, writes logs, and loads dynamic libraries.

From a code-level perspective, the service likely performs a sequence resembling:

1. parsecd.exe is launched as a service or scheduled task under the NT AUTHORITY\SYSTEM account.
2. At startup, the service queries the environment block for %AppData% instead of using the known-good path for the SYSTEM profile (C:\Windows\System32\config\systemprofile\AppData\Roaming).
3. Because the service is spawned in a user session (e.g., via an RPC call, named pipe, or COM interface), the environment block inherits the caller's variables. An attacker who can invoke this service (even as a standard user) can set AppData to a directory they control, such as C:\Users\Public\evil.
4. The service then attempts to load one or more DLLs or configuration files from that attacker-controlled directory. Under the incorrect API usage (e.g., calling LoadLibrary with a relative path resolved against AppData instead of using .rc files from the service's own directory), the resolved path becomes C:\Users\Public\evil\some.dll.

The attack surface is therefore local: any authenticated user on the Windows host who can interact with the Parsec service (e.g., by sending a crafted IPC message through the Parsec named pipe, or by triggering a reconnect or status check) can manipulate the environment and achieve code execution in a SYSTEM context. The incorrect use of privileged APIs is specifically the failure to invoke RegOpenKeyEx or use the TokenHandle from a proper OpenProcessToken to strip untrusted environment variables before spawning child operations.

Additionally, the service may expose a debug/RPC endpoint that listens on a local socket. The attacker can craft an RPC call that includes an environment block, rather than just a plain request. Since the service does not sanitize the AppData pointer before passing it to SHGetKnownFolderPath or GetEnvironmentVariable, it becomes a classic path traversal-to-DLL-hijacking primitive with SYSTEM privileges.

Exploitation Scenarios

This is a local privilege escalation, targeting Windows hosts running Parsec. Attackers typically gain initial access via a phishing email delivering a dropper that establishes a low-privilege beacon (e.g., via Cobalt Strike or Sliver), which then pivots locally to escalate privileges using this flaw.

Step 1: Reconnaissance and Target Identification
The attacker enumerates the victim host for Parsec processes and services:

tasklist /fi "imagename eq parsecd.exe"
sc query parsecsvc
netstat -ano | findstr "8080"

They identify that parsecd.exe is present and that the Parsec service is running as SYSTEM. They also check their current token privileges (whoami /priv) to confirm they are unprivileged.

Step 2: Weaponization and Trigger
The attacker creates a malicious DLL that exports the same functions the service expects to load from its config directory. They stage it as:

C:\Users\Public\evil\version.dll

The DLL contains a payload that spawns a reverse shell or executes a command as SYSTEM. They then craft a small C# or PowerShell script that uses the Parsec RPC interface (e.g., via the named pipe \\.\pipe\parsecd_ipc) to send a control command with a custom environment block, setting:

AppData=C:\Users\Public\evil

Alternatively, they use a scheduled task API call:

$env:AppData = "C:\Users\Public\evil"
Start-Process -FilePath "C:\Program Files\Parsec\parsecd.exe" -ArgumentList "--service"

If the service is already running, the attacker instead forces a reconnect via the RPC, causing the service to re-initialize and re-read the environment.

Step 3: Payload Execution
The attacker triggers the service restart or reconnection. parsecd.exe (running as SYSTEM) reads %AppData% and attempts to load a missing library from that directory. The Windows loader (LoadLibraryEx) resolves the DLL in the attacker-controlled folder and executes its DllMain routine. The malicious code calls:

system("cmd /c net user pwned Password123! /add && net localgroup administrators pwned /add");

or spawns a Beacon with SYSTEM token.

Step 4: Post-Exploitation
The attacker now runs with full SYSTEM privileges. They dump LSASS for credentials, disable Windows Defender, create persistence via a service, and move laterally across the network. The Parsec service's logs are written to the attacker-controlled directory, allowing them to cover forensic traces.

Impact Assessment

The CVSS base score of 8.4 (High) reflects local attack vector, low complexity, and no user interaction beyond the initial execution. The impact subscore is complete for confidentiality, integrity, and availability (C:H/I:H/A:H). The business impact is severe for organizations that rely on Parsec for remote access, cloud gaming, or offsite engineering workstations — a successful exploit yields SYSTEM-level control, allowing attackers to disable security tools, exfiltrate sensitive project data, and deploy ransomware.

The blast radius is potentially high: enterprise environments with hundreds of Windows endpoints running Parsec are all equally vulnerable. Because the patched version (150-104a) has been released but is not yet widely tracked or deployed, most current installations remain exposed. The EPSS score of 0.00245 indicates low immediate exploitation probability in the wild, but this is expected for local-only vulnerabilities that require an initial foothold; the probability will rise once weaponized exploit code is public.

Detection Guidance

Sigma Rule

title: Parsec parsecd.exe AppData Environment Variable Hijacking
id: 4a3b8068-473f-4e93-bcde-82c673f48c22
status: experimental
description: Detects the presence of parsecd.exe invoking a DLL load from a non-standard AppData path, indicating exploitation of CVE-2026-54424.
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: '\parsecd.exe'
  selection_env:
    EnvironmentVariable|contains: 'AppData'
  selection_path:
    CommandLine|contains:
      - 'C:\Users\Public'
      - 'C:\Temp'
      - '%TEMP%'
      - 'C:\ProgramData'
  condition: selection_img and selection_env and selection_path
  timeframe: 5m
level: high
falsepositives:
  - Legitimate user configurations redirecting AppData to non-standard locations
  - Some corporate images pre-install Parsec with custom AppData paths
tags:
  - attack.privilege_escalation
  - attack.t1068
  - cve.2026-54424

YARA Rule

rule CVE_2026_54424_Parsec_AppData_Hijack
{
    meta:
        author = "Valter SiT SOC"
        description = "Detects malicious DLLs targeting Parsec AppData hijacking for CVE-2026-54424"
        cve = "CVE-2026-54424"
        date = "2026-05-15"
        severity = "high"
    strings:
        $s1 = "AppData" ascii wide
        $s2 = "parsecd" ascii wide
        $s3 = "C:\\Users\\Public" ascii wide
        $s4 = "LoadLibrary" ascii wide
        $s5 = "CreateProcess" ascii wide
    condition:
        uint16(0) == 0x5A4D and 2 of ($s*) 
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-54424 Parsec AppData RPC Exploitation Attempt"; flow:to_server,established; content:"AppData"; nocase; content:"\\Users\\Public\\"; distance:0; within:100; classtype:attempted-admin; sid:2026054401; rev:1; reference:cve,2026-54424;)

Elastic Detection

sequence by host.name with maxspan=10m
  [process where event.action == "start" and process.name == "parsecd.exe"]
  [file where event.action == "modification" and file.path : ("C:\\Users\\Public\\*", "C:\\Temp\\*", "C:\\ProgramData\\*") and file.name : "*.dll"]

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security
| where CommandLine LIKE "*parsecd.exe*" OR Image LIKE "*parsecd.exe*"
| regex CommandLine="(?i)AppData"
| regex CommandLine="(?i)(C:\\Users\\Public|C:\\Temp|C:\\ProgramData)"
| stats count by host, user, CommandLine, _time
| sort -_time

Wazuh OSSEC Rule

<group name="local,privesc,">
  <rule id="100201" level="12">
    <if_sid>5715</if_sid>
    <match>parsecd.exe</match>
    <regex>\bAppData\b</regex>
    <description>Potential CVE-2026-54424 exploitation: parsecd.exe launched with attacker-controlled AppData path.</description>
    <options>no_full_log</options>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>cve-2026-54424,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).
Despite the vendor stating version 150-104a fixes the issue, automated patch feeders have not observed or verified this release. Treat the system as unpatched until you manually confirm the installed binary hash.

Immediate Mitigations (until patched):

1. Restrict logon access to any Windows host running Parsec to trusted personnel only; disable local user accounts where possible.
2. Configure Windows Defender Application Control (WDAC) to only allow signed DLLs in %AppData% for the Parsec service account.
3. Use Sysmon and Windows Event ID 7 (Image Loaded) to monitor DLL loads from non-standard paths for parsecd.exe.
4. Run the Parsec service under a non-SYSTEM account with reduced privileges if the environment allows.

Patch/Upgrade Steps:

1. Download Parsec for Windows version 150-104a from the official vendor portal.
2. Verify the digital signature and SHA-256 hash against the vendor's published checksum.
3. Run the installer in an elevated context and restart the service.
4. Confirm the running version with: parsecd.exe --version and ensure it outputs 150-104a or later.

Long-Term Hardening:

• Adopt a least-privilege model where remote access tools run under dedicated domain accounts with GPO-managed AppData redirection.
• Implement application whitelisting via AppLocker or WDAC across enterprise fleets.
• Subscribe to NVD and vendor RSS feeds; automate patch deployment with a 48-hour SLA for critical local privilege escalation CVEs.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-54424
2. Unity Parsec Release Notes (v150-104a): https://parsec.app/blog/release-notes
3. MITRE ATT&CK Technique T1068 (Exploitation for Privilege Escalation): https://attack.mitre.org/techniques/T1068/
4. CWE-648 (Incorrect Use of Privileged APIs): https://cwe.mitre.org/data/definitions/648.html
5. CISA Known Exploited Vulnerabilities Catalog (not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: As of this writing, no public exploit code or in-the-wild campaigns have been attributed to CVE-2026-54424. The EPSS percentile (15.8%) suggests minimal active exploitation. However, given the history of Parsec being targeted by cryptojacking campaigns and post-exploitation tooling, monitor for local privilege escalation chains following initial access via RDP brute force or phishing.