CVE-2023-45894

Severity: critical (CVSS 10.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-12-14 · updated 2026-06-17

Description

The Remote Application Server in Parallels RAS before 19.2.23975 does not segment virtualized applications from the server, which allows a remote attacker to achieve remote code execution via standard kiosk breakout techniques.

Affected products

Parallels Remote Application Server (Client): before 19.2.23975 — fixed in 19.2.23975

How to fix

Upgrade to a fixed version: Parallels Remote Application Server (Client) 19.2.23975. Check the vendor advisory for mitigations.

References

https://github.com/Oracle-Security/CVEs/blob/main/Parallels%20Remote%20Server/readme.md
https://github.com/Oracle-Security/CVEs/blob/main/Parallels%20Remote%20Server/readme.md

Get alerted when CVE-2023-45894 or the next vulnerability affects your stack