CVE-2026-25039
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-25039 is a high-severity Windows UNC Share (CWE-40) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Forced Authentication (T1187); ranked at the 45th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-45968
Vulnerability Data
Parsec is a cloud-based application for simple and cryptographically secure file sharing. The application does not sanitize the workspace name, creating a vulnerability if that workspace name is a UNC path. When creating mountpoint in the windows filesystem to mount…
more
the workspace of an organization, the application does not sanitize the workspace name. The cause issue if the workspace name evaluate to a UNC path since it's allowed for the name to containt `\` char. If the UNC path is invalid (or the targeted resource is not available) the application become unresponsive otherwise the system will interact with the mounted UNC path allowing the attacker to retrieve to [`NTLM`] hash.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Input validation directly rejects malformed or malicious UNC paths before they are resolved to unintended locations.
Enforced access authorizations can limit damage from a traversed UNC path even if the path itself is accepted.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Identifying and recording vulnerabilities enables discovery and remediation of path traversal flaws before exploitation.
Least-privilege enforcement limits the damage an attacker can achieve via a malicious UNC path.
Secure SDLC practices directly prevent introduction of unsafe path-handling code such as UNC traversal.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Network security controls can block or filter UNC paths that traverse outside approved shares.
Application security requirements can mandate input validation to reject malicious UNC paths.
Secure architecture principles include canonicalization and path-handling controls that prevent UNC traversal.
Secure coding standards directly require validation and sanitization of file paths including UNC shares.
Security testing can discover and verify the absence of UNC-based path traversal vulnerabilities.
Information access restriction policies can limit which UNC paths users or processes may reach.