CVE-2022-40870: Parallels Remote Application Server

High severity, CVSS 8.1. EPSS: 2.1% chance of exploitation in the next 30 days.

The Web Client of Parallels Remote Application Server v18.0 is vulnerable to Host Header Injection attacks. This vulnerability allows attackers to execute arbitrary commands via a crafted payload injected into the Host header.

Affected products

• Parallels Remote Application Server: version 18.0 only

Published 2022-11-23. Last modified 2026-06-17.