CVE-2026-25039: Parsec Cloud UNC Path DOS Vulnerability

CVE-2026-25039 Overview

CVE-2026-25039 affects Parsec, a cloud-based application for cryptographically secure file sharing developed by Scille. The vulnerability stems from missing input sanitization on workspace names when the Windows client creates a mountpoint for an organization's workspace. Because the workspace name accepts the backslash (\) character, an attacker can craft a name that resolves to a Universal Naming Convention (UNC) path. When Windows mounts the workspace, the operating system interacts with the attacker-controlled UNC target and transmits the current user's NT LAN Manager (NTLM) hash to that remote host.

Critical Impact
An authenticated attacker with workspace-creation privileges can coerce Parsec clients into leaking NTLM authentication hashes to an attacker-controlled Server Message Block (SMB) endpoint, or freeze the client if the UNC target is unreachable.

Affected Products

Parsec Cloud desktop client on Microsoft Windows
Parsec workspace mount functionality on Windows filesystems
Deployments where multiple users share access to organizations and workspaces

Discovery Timeline

2026-07-20 - CVE-2026-25039 published to the National Vulnerability Database (NVD)
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-25039

Vulnerability Analysis

Parsec creates a filesystem mountpoint on Windows to expose each organization workspace as a browsable drive. The client uses the workspace name directly when constructing the mountpoint path. The workspace name field allows backslash characters, so any user with permission to create a workspace can supply a value such as \\attacker.example.com\share. Windows interprets that string as a UNC path and initiates an SMB connection to the specified host. During SMB negotiation, Windows transmits the NTLM challenge-response, which contains the current user's NetNTLMv2 hash. The attacker captures the hash offline for cracking or relay attacks. The issue is classified under [CWE-40] (Path Traversal: Windows UNC Share).

Root Cause

The Parsec client does not validate or sanitize the workspace name string before passing it to the Windows filesystem mount routine. No allow-list restricts characters to safe filename components, and no check rejects strings beginning with \\ that Windows treats as UNC paths.

Attack Vector

An authenticated user with workspace-creation rights in a shared Parsec organization sets the workspace name to a malicious UNC path pointing at an SMB listener under their control. When any other member of the organization synchronizes and mounts that workspace, their Windows host connects to the attacker's SMB server and forwards NTLM credentials. If the UNC target is unreachable, the Parsec client hangs, producing a denial-of-service condition on the victim endpoint.

No verified proof-of-concept code has been published. See the GitHub Security Advisory GHSA-qx56-wxpm-j4m6 for technical details.

Detection Methods for CVE-2026-25039

Indicators of Compromise

Outbound SMB traffic (TCP 445) from Windows endpoints running Parsec to unexpected external or internal hosts immediately after a workspace mount event.
Parsec client processes becoming unresponsive shortly after synchronizing new workspace metadata from an organization.
Workspace names visible in the Parsec UI that contain \\ sequences or resemble hostnames or IP addresses.

Detection Strategies

Inspect Parsec organization workspace metadata for names containing backslashes, colons, or characters outside a standard filename allow-list.
Correlate Parsec process activity with new outbound SMB or WebDAV connections to hosts not on the internal file-server inventory.
Alert on Windows Security event ID 4624 or 4625 logons originating from Parsec-hosting endpoints against untrusted destinations.

Monitoring Recommendations

Enable network egress logging for TCP 445 and TCP 139 and block those ports at the perimeter where operationally feasible.
Enable NTLM auditing via Group Policy (Network security: Restrict NTLM: Audit Outgoing NTLM Traffic) to record outbound NTLM authentication attempts.
Monitor Parsec application logs for workspace mount failures and repeated unresponsive-state events indicative of exploitation attempts.

How to Mitigate CVE-2026-25039

Immediate Actions Required

Upgrade the Parsec client to the fixed release referenced in the vendor advisory as soon as it is available in your environment.
Audit existing workspaces across all organizations and rename or remove any workspace whose name contains \\, forward slashes, or other suspicious path characters.
Restrict workspace creation privileges to trusted administrators until patched clients are deployed.

Patch Information

Scille has published remediation guidance in the GitHub Security Advisory GHSA-qx56-wxpm-j4m6. Apply the fixed version of the parsec-cloud Windows client to all endpoints. Confirm that the updated client rejects workspace names containing UNC-forming character sequences.

Workarounds

Block outbound SMB traffic (TCP 445 and 139) at host and network firewalls to prevent NTLM hash exfiltration to external endpoints.
Configure the Windows Group Policy setting Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers to Deny all on Parsec-hosting endpoints.
Limit workspace-creation permissions in Parsec organizations to a small set of trusted administrators pending client updates.

bash

# Example: block outbound SMB via Windows Defender Firewall
New-NetFirewallRule -DisplayName "Block Outbound SMB 445" `
  -Direction Outbound -Action Block -Protocol TCP -RemotePort 445

New-NetFirewallRule -DisplayName "Block Outbound NetBIOS 139" `
  -Direction Outbound -Action Block -Protocol TCP -RemotePort 139