PT-2026-61598 · Parsec · Parsec

CVE-2026-25039 · Published 2026-07-20 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Parsec (affected versions not specified)

Description Parsec is a cloud-based application for secure file sharing. The application fails to sanitize the workspace name when creating a mountpoint in the Windows filesystem to mount an organization's workspace. Because the workspace name can contain the `` character, it can be set to a UNC (Universal Naming Convention) path. If the UNC path is valid, the system interacts with it, which allows an attacker to retrieve the NTLM (New Technology LAN Manager) hash, a protocol used for authentication in Windows environments. If the path is invalid or the resource is unavailable, the application becomes unresponsive.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-40

Related Identifiers

CVE-2026-25039

GHSA-QX56-WXPM-J4M6

Affected Products

Parsec

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25039.json · Exploit
• 🔥 https://github.com/Scille/parsec-cloud/security/advisories/GHSA-qx56-wxpm-j4m6 · Exploit
• https://osv.dev/vulnerability/CVE-2026-25039 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25039 · Security Note
• https://twitter.com/infoflowcloud/status/2079240317048324178 · Twitter Post
• https://twitter.com/CVEnew/status/2079238935486611685 · Twitter Post