CVE-2025-0413: Parallels Desktop Technical Data Reporter Link Following Local Privilege Escalation Vulnerability

Routine

HIGH 7.8UPGRADEUPGRADE

CVE-2025-0413 is a high-severity flaw (CVSS 7.8) affecting remote application server, parallels. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Parallels Desktop Technical Data Reporter Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this vulnerability. The specific flaw exists within the Technical Data Reporter component. By creating a symbolic lin

Why this priority

High severity

A fixed release or distro patch exists.

Risk facts

CVSS score	7.8 (High)
Attack vector	Local
Attack complexity	Low
Privileges needed	Low
User interaction	None
EPSS exploit chance	0.4% (top 64%)
CISA exploited list	No
Weakness	CWE-59
Published	2025-02-05
Last modified	2026-06-17

Publisher (CNA): Zero Day Initiative · Vendor: parallels

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2025-02-05 00:15 UTCPublished CVE record published
2026-06-17 08:26 UTCUpdated Record last modified

parallels remote application server UPGRADE

Affected: < 19.4.3.2-25228

Fixed in: 19.4.3.2-25228

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy remote-application-server || rpm -q remote-application-server || remote-application-server --version

2. UPGRADE to 19.4.3.2-25228 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade remote-application-server

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade remote-application-server

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

parallels parallels UPGRADE

Affected: >= 19.0-23304 and < 19.4.3-25221 · >= 20.0-25389 and < 20.2-25889

Fixed in: 19.4.3-25221, 20.2-25889

Safe to downgrade to: a release before 19.0-23304

1. Check installed version

apt-cache policy parallels || rpm -q parallels || parallels --version

2. UPGRADE to 19.4.3-25221 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade parallels

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade parallels

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 19.0-23304 (Debian / Ubuntu)

apt-cache madison parallels sudo apt install parallels=<VERSION_BEFORE_19.0-23304> sudo apt-mark hold parallels

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list parallels sudo dnf downgrade parallels-<VERSION_BEFORE_19.0-23304> sudo dnf versionlock add parallels

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2025-0413?

remote application server: upgrade to 19.4.3.2-25228; parallels: upgrade to 19.4.3-25221, 20.2-25889. Exact commands for each OS are on this page.

Is CVE-2025-0413 being exploited?

CVE-2025-0413 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2025-0413 affect?

CVE-2025-0413 affects remote application server, parallels. Severity is high (CVSS 7.8). Parallels Desktop Technical Data Reporter Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obta

How urgent is CVE-2025-0413?

Priority 36/100. High severity

References

← Back to latest CVEs