CVE-2020-15860

Parallels Remote Application Server (RAS) 17.1.1 has a Business Logic Error causing remote code execution. It allows an authenticated user to execute any application in the backend operating system through the web application, despite the affected application not being published. In addition, it was discovered that it is possible to access any host in the internal domain, even if it has no published applications or the mentioned host is no longer associated with that server farm.

• https://kb.parallels.com/en/125112Vendor Advisory
• https://www.coresecurity.com/core-labs/advisories/parallels-ras-os-command-executionExploit, Third Party Advisory
• https://www.parallels.com/products/ras/remote-application-server/Product
• https://kb.parallels.com/en/125112Vendor Advisory
• https://www.coresecurity.com/core-labs/advisories/parallels-ras-os-command-executionExploit, Third Party Advisory
• https://www.parallels.com/products/ras/remote-application-server/Product

Published

Jul 24, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15851Lack of access control in Nakivo Backup & Replication Transp…9.8
• CVE-2020-15852An issue was discovered in the Linux kernel 5.5 through 5.7.…7.8
• CVE-2020-15853supybot-fedora implements the command 'refresh', that refres…5.3
• CVE-2020-15855Two cross-site scripting vulnerabilities were fixed in Bodhi…6.1
• CVE-2020-15858Some devices of Thales DIS (formerly Gemalto, formerly Cinte…6.4
• CVE-2020-15859QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c beca…3.3
• CVE-2020-15861Net-SNMP through 5.7.3 allows Escalation of Privileges becau…7.8
• CVE-2020-15862Net-SNMP through 5.8 has Improper Privilege Management becau…7.8
• CVE-2020-15863hw/net/xgmac.c in the XGMAC Ethernet controller in QEMU befo…5.3
• CVE-2020-15864An issue was discovered in Quali CloudShell 9.3. An XSS vuln…6.1
• CVE-2020-15865A Remote Code Execution vulnerability in Stimulsoft (aka Sti…9.8
• CVE-2020-15866mruby through 2.1.2-rc has a heap-based buffer overflow in t…9.8