Parallels has released fixed HALB appliances for the RAS 21.2 and RAS 22.0 branches. The update addresses the critical CVE-2026-98432 Linux kernel vulnerability.
Available builds
Parallels RAS 21.2 · HALB: v21.2.2.3-27435
Parallels RAS 22.0 · HALB: v22.0.0.1-28161
Why is this update critical?
CVE-2026-98432 is a remote, unauthenticated vulnerability exploitable over TCP/IPv4. It can cause denial of service or memory corruption and could theoretically enable remote code execution. Its CVSS score is 9.8/10. Parallels provides no workaround, so installing the fixed image promptly is recommended, especially when the appliance is Internet-facing.
What should you do?
Download the image matching your branch and hypervisor from the official Parallels RAS download page. Then make sure management, SSH and console interfaces are not publicly exposed and that only the required load-balancing ports are reachable.
Read the official Parallels security advisory ↗
