CVE-2023-27328 - CVE House
Back to Database
Status published High CVE-2023-27328

Parallels Desktop Toolgate XML Injection Local Privilege Escalation Vulnerability

Vulnerability Description

Parallels Desktop Toolgate XML Injection Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of a user-supplied string before using it to construct an XML document. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-19187.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-27328

Credits & Attribution

No credits recorded in the NVD database.

References

More from Parallels

View All →
CVE-2025-31359
A directory traversal vulnerability exists in the PVMP package unpacking...
High 8.8
CVE-2025-30074
Alludo Parallels Desktop before 19.4.2 and 20.x before 20.2.2 for...
High 7.8
CVE-2025-0413
Parallels Desktop Technical Data Reporter Link Following Local Privilege Escalation Vulnerability
High 7.8
CVE-2024-6240
Improper privilege management vulnerability in Parallels Desktop
High 7.7
CVE-2024-6154
Parallels Desktop Toolgate Heap-based Buffer Overflow Local Privilege Escalation Vulnerability
High 8.2

Affected Vendor

Affected Software

Desktop
Vulnerable Versions:
18.0.2

Timeline

Official Publish: May 3rd, 2024
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-91

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.