What’s Vulnerable › Vulnerabilities

CVE-2020-8968: Parallels Remote Application Server credentials management errors

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-12-17 · updated 2026-06-17
• Weakness: CWE-255

Description

Parallels Remote Application Server (RAS) allows a local attacker to retrieve certain profile password in clear text format by uploading a previously stored cyphered file by Parallels RAS. The confidentiality, availability and integrity of the information of the user could be compromised if an attacker is able to recover the profile password.

Affected products

• Parallels Remote Application Server (Client): from 15.5 through 17.0

References

• https://www.incibe.es/en/incibe-cert/notices/aviso/parallels-remote-application-server-credentials-management-errors
• https://www.incibe.es/en/incibe-cert/notices/aviso/parallels-remote-application-server-credentials-management-errors

Get alerted when CVE-2020-8968 or the next vulnerability affects your stack