CVE-2023-27323

Parallels Desktop Updater Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this vulnerability. The specific flaw exists within the Updater service. By creating a symbolic link, an attacker can abuse the service to execute a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. . Was ZDI-CAN-18150.

• CWE-367

• https://kb.parallels.com/125013Vendor Advisory
• https://www.zerodayinitiative.com/advisories/ZDI-23-217/Third Party Advisory
• https://kb.parallels.com/125013Vendor Advisory
• https://www.zerodayinitiative.com/advisories/ZDI-23-217/Third Party Advisory

Published

May 3, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-27318StorageGRID (formerly StorageGRID Webscale) versions 11.6.0 …7.5
• CVE-2023-27319ONTAP Mediator versions prior to 1.7 are susceptible to a v…5.3
• CVE-2023-2732The MStore API plugin for WordPress is vulnerable to authent…9.8
• CVE-2023-27320Sudo before 1.9.13p2 has a double free in the per-command ch…7.2
• CVE-2023-27321OPC Foundation UA .NET Standard ConditionRefresh Resource Ex…7.5
• CVE-2023-27322Parallels Desktop Service Improper Initialization Local Priv…7.8
• CVE-2023-27324Parallels Desktop Updater Improper Initialization Local Priv…7.8
• CVE-2023-27325Parallels Desktop Updater Improper Initialization Local Priv…7.8
• CVE-2023-27326Parallels Desktop Toolgate Directory Traversal Local Privile…8.2
• CVE-2023-27327Parallels Desktop Toolgate Time-Of-Check Time-Of-Use Local P…7.5
• CVE-2023-27328Parallels Desktop Toolgate XML Injection Local Privilege Esc…7.8
• CVE-2023-27329Foxit PDF Reader Annotation Use-After-Free Remote Code Execu…7.8