CVE-2026-54424: Unity Parsec Privilege Escalation Flaw

CVE-2026-54424 Overview

CVE-2026-54424 is an elevation of privilege vulnerability in Unity Parsec on Windows hosts. The flaw stems from incorrect use of privileged APIs, tracked as [CWE-648]. It affects Parsec through version v2026-05-04.0 and is fixed in Parsec for Windows version 150-104a. A local user can create a condition where parsecd.exe runs as NT AUTHORITY\SYSTEM while the AppData environment variable remains under user control. Attackers abuse this state to influence file paths and resources loaded by the elevated process, resulting in code execution at SYSTEM level.

Critical Impact
A local unprivileged user can escalate to NT AUTHORITY\SYSTEM on Windows hosts running vulnerable Parsec builds, gaining full control of the endpoint.

Affected Products

Unity Parsec for Windows through version v2026-05-04.0
Parsec desktop client on Windows hosts
All Parsec deployments prior to build 150-104a

Discovery Timeline

2026-07-04 - CVE-2026-54424 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-54424

Vulnerability Analysis

The vulnerability arises from how the Parsec service invokes privileged Windows APIs while relying on environment variables inherited from an unprivileged user context. When parsecd.exe runs as NT AUTHORITY\SYSTEM, the process trusts the AppData environment variable to resolve configuration and data paths. Because that variable remains attacker-controlled, the elevated process reads or executes resources from locations chosen by a low-privilege user.

This pattern maps to [CWE-648]: Incorrect Use of Privileged APIs. The privileged process fails to sanitize or reset the untrusted environment before performing security-sensitive file operations. The result is a local elevation of privilege from a standard user account to SYSTEM.

Root Cause

The root cause is a trust boundary violation. Parsec elevates a component to SYSTEM without stripping the user-controlled environment block, then uses %AppData% as an input to file path construction. Windows privileged services should either build absolute paths independently or explicitly clear inherited environment variables before touching the file system.

Attack Vector

Exploitation requires local access to the Windows host with an interactive user session. The attacker sets AppData to a directory they control, then triggers the workflow that spawns parsecd.exe as SYSTEM. The elevated process reads configuration, plugins, or dependent files from the attacker-controlled path, executing attacker-supplied content with SYSTEM privileges. A proof of concept is published in the GitHub PoC Repository and analyzed in the Tomadimitrie Blog Post.

No verified exploit code is reproduced here. Refer to the linked references for technical proof-of-concept details.

Detection Methods for CVE-2026-54424

Indicators of Compromise

Instances of parsecd.exe running under NT AUTHORITY\SYSTEM while referencing an AppData path outside C:\Users\<user>\AppData\Roaming.
Creation of unexpected files or DLLs in user-writable directories that are subsequently loaded by a SYSTEM-level Parsec process.
Process creation events showing parsecd.exe spawning child processes such as cmd.exe or powershell.exe with SYSTEM integrity.

Detection Strategies

Hunt for parsecd.exe processes where the parent user token is unprivileged but the resulting integrity level is System.
Correlate SetEnvironmentVariable or CreateProcess calls that pass a non-default AppData value into privileged Parsec binaries.
Alert on file writes to unusual AppData locations immediately followed by module loads inside a SYSTEM-owned Parsec process.

Monitoring Recommendations

Enable Windows Sysmon event IDs 1 (process creation) and 7 (image load) for parsecd.exe and associated Parsec services.
Monitor the Parsec installation directory and any referenced %AppData%\Parsec paths for unexpected write activity from standard users.
Track privilege elevation events (Event ID 4672) tied to Parsec service accounts on endpoints with the vulnerable version installed.

How to Mitigate CVE-2026-54424

Immediate Actions Required

Upgrade Parsec for Windows to version 150-104a or later on every affected host.
Inventory endpoints running Parsec versions at or below v2026-05-04.0 and prioritize patching multi-user or shared systems.
Restrict interactive logon on hosts where Parsec is deployed until the patch is applied.

Patch Information

Unity has released Parsec for Windows version 150-104a, which remediates the incorrect use of privileged APIs. Vendor guidance is documented in the Parsec Support Article. Administrators should deploy the fixed build through their standard software distribution channels and confirm the new version reports in endpoint inventory.

Workarounds

Remove or disable Parsec on Windows hosts where immediate patching is not feasible.
Enforce least privilege so untrusted users cannot log on interactively to systems running vulnerable Parsec builds.
Configure application allowlisting to block execution of binaries loaded from user-writable AppData paths by SYSTEM-level processes.

bash

# Verify installed Parsec version on Windows (PowerShell)
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Parsec*" } |
  Select-Object DisplayName, DisplayVersion, InstallLocation