CVE-2026-54424 Details
Description
An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hosts leads to a potential Elevation of Privilege. This issue affects Parsec through v2026-05-04.0. The patched version is Parsec for Windows version 150-104a. A user can generate a situation where there is an instance of parsecd.exe running as NT AUTHORITY\SYSTEM with a user-controlled value of the AppData environment variable.
A vulnerability allowing elevation of privilege has been identified in Unity Parsec for Windows, affecting versions prior to 150-104a. The issue arises from an incorrect use of privileged APIs, where a user can manipulate the AppData environment variable to create a situation where 'parsecd.exe' runs as 'NT AUTHORITY\SYSTEM'. This vulnerability can be exploited by authenticated users who have Parsec installed using the 'Per User' option.
Users can update to Parsec for Windows version 150-104a or later. Instructions for updating are available on the Parsec support page.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-648 | Incorrect Use of Privileged APIs | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 6, 2026 | CVE Modified | CISA-ADP |
| Jul 4, 2026 | New CVE Received | [email protected] |