Security update for Parallels RAS (October 2026): Node.js and .NET components, status and optional precaution

Overview

In October 2026, Node.js and Microsoft .NET both published security updates, including a fix for CVE-2026-111497. Parallels RAS uses both components, including in the RAS User Portal on the Secure Gateway. Because of this, some security scanners may flag RAS Secure Gateway servers. Many vendors are issuing updates for these components, not only Parallels.

Our engineering team has reviewed the issue. RAS does not use the affected Brotli decoder directly, and we have not identified a direct exposure. We are not aware of any customer being affected by an exploit. As a precaution, and to make sure the latest security patches are applied, we are updating the Node.js and .NET components in all supported versions.

Current status

A build with the updated Node.js component is already running internally. We are releasing the updates in phases, starting with the components that can be reached from outside the network:

1. RAS 21 (current GA): the first hotfix covers externally reachable components such as the Secure Gateway and User Portal. We expect to release it in the next few days.
2. RAS 20: a hotfix follows after that.
3. Internal components: further hotfixes will cover components that are typically not reachable from outside the network.
4. RAS 22: the updated components are included in the 22.0 release.

This article will be updated as each build is released.

Recommended action

Install the update for your version once it is available. If you run an older, unsupported version, we recommend that you upgrade to a supported version. No other action is required in the meantime.

Optional: additional precaution until you can update

This step is not required. If you want an extra precaution before you install the update, for example on an older version, you can temporarily disable the User Portal on your RAS Secure Gateways. This precaution applies only to the User Portal. The Parallels Client is not affected, so users can keep connecting with it.

1. In the RAS Console, go to Farm > <Site> > Secure Gateways.
2. Right-click a Secure Gateway and select Properties.
3. Open the User Portal tab.
4. If Inherit default settings is selected, clear it.
5. Clear Enable User Portal.
6. Click OK, then click Apply in the RAS Console.
7. Repeat these steps for every Secure Gateway in the Farm.

Note: The User Portal tab is available only when the Secure Gateway is in Normal mode.

Important: While the User Portal is disabled, users cannot connect from a web browser and must use the Parallels Client.

How to re-enable the User Portal

After you install the update, re-enable the User Portal on each Secure Gateway. Select Enable User Portal again, or select Inherit default settings if the gateway used the Site defaults before.

For more information, see Enable or disable User Portal in the Parallels RAS Administrator's Guide.