How severe is CVE-2026-25039?

CVE-2026-25039 has a CVSS 3.x base score of 8.8, rated high severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2026-25039 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (36th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-25039?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2026-25039 published?

CVE-2026-25039 was published on 2026-07-20 and last updated on 2026-10-24.

CVE-2026-25039

CVE-2026-25039 is a high-severity vulnerability with a CVSS 3.x base score of 8.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-40.

Key facts

Severity: High (CVSS 3.x base score 8.8)
EPSS exploit prediction: 0% (36th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-40
Published: 2026-07-20
Last modified: 2026-10-24

Description

Parsec is a cloud-based application for simple and cryptographically secure file sharing. The application does not sanitize the workspace name, creating a vulnerability if that workspace name is a UNC path. When creating mountpoint in the windows filesystem to mount the workspace of an organization, the application does not sanitize the workspace name. The cause issue if the workspace name evaluate to a UNC path since it's allowed for the name to containt `\` char. If the UNC path is invalid (or the targeted resource is not available) the application become unresponsive otherwise the system will interact with the mounted UNC path allowing the attacker to retrieve to [`NTLM`] hash.

Frequently asked questions

What is CVE-2026-25039?: Parsec is a cloud-based application for simple and cryptographically secure file sharing. The application does not sanitize the workspace name, creating a vulnerability if that workspace name is a UNC path. When creating mountpoint in the windows filesystem to mount the workspace of an organization, the application does not sanitize the workspace name. The cause issue if the workspace name evaluate to a UNC path since it's allowed for the name to containt `\` char. If the UNC path is invalid (or the targeted resource is not available) the application become unresponsive otherwise the system will interact with the mounted UNC path allowing the attacker to retrieve to [`NTLM`] hash.
How severe is CVE-2026-25039?: CVE-2026-25039 has a CVSS 3.x base score of 8.8, rated high severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2026-25039 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (36th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-25039?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2026-25039 published?: CVE-2026-25039 was published on 2026-07-20 and last updated on 2026-10-24.

References

https://github.com/Scille/parsec-cloud/security/advisories/GHSA-qx56-wxpm-j4m6

Other CWE-40 vulnerabilities

CVE-2026-82819 — High (CVSS 7.1): A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a…

Browse all CWE-40 vulnerabilities →