Parallels Desktop local flaw leaves Intel Macs without a confirmed fix
JFrog has disclosed CVE-2026-90894, dubbed ParaShells, a local privilege-escalation flaw in Parallels Desktop for Mac. The researcher rates the issue 7.8 out of 10 and demonstrated it on Parallels Desktop 26.4.0 build 57513 on an Apple silicon Mac, where a non-administrator account could execute code as root.
JFrog says the remediation is present in Parallels Desktop 27.0.0 and later, while the latest release in that line, 27.0.1 build 58670, was released on 1 September 2026. The complication is that version 27 requires Apple silicon and macOS Sonoma 14.7 or newer. Intel Mac owners are directed to remain on the 26.x line, which JFrog does not describe as fixed.
How the local root escalation works
Parallels Desktop runs Windows and Linux virtual machines on macOS and installs the prl_disp_service background service with root privileges. Its responsibilities include host networking configuration and unpacking virtual-machine packages. The vulnerable component is on the Mac host, not inside a guest virtual machine.
On the system examined by JFrog, the service socket was world-writable, allowing any local process to connect. The following PrlSrv_LoginLocal call relies on credentials reported by the kernel for the connecting process, without requiring a Parallels code signature or administrator privileges.
When installing a virtual-machine appliance, the service builds an extraction command as text and later parses it with Qt's QProcess::splitCommand. A user-controlled destination folder containing a double quote can terminate the intended quoting and inject additional tar options. JFrog used --use-compress-program, causing the root-run tar process to launch another program with root privileges.
The attack is not remotely exploitable on its own: an attacker needs code execution as a standard local user. JFrog noted that a malicious Homebrew formula, poisoned npm installation script, compromised build job, or weak account on a shared Mac could provide that starting point. A virtual machine does not need to be active for the service to be reachable.
Version uncertainty and Intel constraints
JFrog's advisory lists releases below 27.0.0 as affected and names 27.0.0 as the fixed version. Its disclosure timeline says the fix shipped on 1 September, whereas Parallels release notes date 27.0.0 to 25 August and 27.0.1 to 1 September. Updating eligible systems to 27.0.1 covers both dates, although Parallels has not published a statement identifying the build that repairs CVE-2026-90894.
Parallels has said Intel users should continue with version 26 and expect future security and maintenance updates. Yet JFrog states that hosts remaining on 26.x, including 26.4.2, do not have the relevant extraction change. JFrog did not regression-test every older build, and Parallels' concise 26.4.2 release notes do not establish whether an undocumented repair exists.
Checks and operational response
Administrators can inspect the installed version with defaults read "/Applications/Parallels Desktop.app/Contents/Info" CFBundleShortVersionString and review socket permissions with ls -l /var/run/prl_disp_service.socket. JFrog says a socket shown as srwxrwxrwx on a build at or near 26.4.0 should be treated as exposed until a patched build is confirmed. These checks indicate exposure conditions, not whether the flaw has been abused.
Businesses should inventory Macs running Parallels Desktop, deploy version 27.0.1 where hardware and operating-system requirements permit it, and validate device-management rules before pushing a new major version to Intel Macs. For systems that must remain on 26.x, limiting local logins reduces the available attack path while Parallels has not confirmed a fixed Intel-compatible build; teams should also investigate suspected compromise because root access can be retained through launchd after an update.