CVE-2020-15860 json
Parallels Remote Application Server (RAS) 17.1.1 has a Business Logic Error causing remote code execution.
published 2020-07-24 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-7841
- cvss
- 9.9
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 4.0%
- EPSS 4.0% chance of exploitation in 30 days, percentile 90%
- public exploits
- 0
- none known
Summary
Parallels Remote Application Server (RAS) 17.1.1 has a Business Logic Error causing remote code execution. It allows an authenticated user to execute any application in the backend operating system through the web application, despite the affected application not being published. In addition, it was discovered that it is possible to access any host in the internal domain, even if it has no published applications or the mentioned host is no longer associated with that server farm.
Exploit prediction
4.01% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- coresecurity.com https://www.coresecurity.com/core-labs/advisories/parallels-ras-os-command-execution referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
References
-
coresecurity.com
/core-labs/advisories/parallels-ras-os-command-execution
exploit, third-party-advisory
-
kb.parallels.com
/en/125112
vendor-advisory
-
parallels.com
/products/ras/remote-application-server/
product
Sources
- CVE List CVE-2020-15860
- NVD CVE-2020-15860
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.