CVE-2026-54424

The record

An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hosts leads to a potential Elevation of Privilege. This issue affects Parsec through v2026-05-04.0. The patched version is Parsec for Windows version 150-104a. A user can generate a situation where there is an instance of parsecd.exe running as NT AUTHORITY\SYSTEM with a user-controlled value of the AppData environment variable.

Affected packages

Related vulnerabilities

• CVE-2026-11877 An unauthorized user can modify configuration through API calls that affects the OpenText… CWE-648
• CVE-2026-9560 Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on… CWE-648
• CVE-2026-41225 A vulnerability exists in iControl REST where a highly privileged, authenticated attacker… CWE-648
• CVE-2026-41386 OpenClaw before 2026.3.22 contains a privilege escalation vulnerability where bootstrap… CWE-648
• CVE-2026-41329 OpenClaw before 2026.3.31 contains a sandbox bypass vulnerability allowing attackers to… CWE-648
• CVE-2026-35669 OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in… CWE-648
• CVE-2026-35663 OpenClaw before 2026.3.25 contains a privilege escalation vulnerability allowing… CWE-648
• GHSA-m5jp-p3r5-mfqp Duplicate Advisory: OpenClaw: Gateway Plugin Subagent Fallback `deleteSession` Uses… CWE-648