A severe privilege escalation vulnerability has been uncovered in the popular virtualization software Parallels Desktop for macOS. According to security researchers at JFrog, the flaw tracked as CVE-2026-90894 and dubbed “ParaShells” allows standard local users to seize complete control of the operating system at the root level.
Socket Permissions and Unverified Clients Open the Door
The security flaw carries a CVSS score of 7.8. JFrog’s analysis indicates that the root cause lies in the software’s background service, the root daemon prl_disp_service. It listens on the Unix domain socket /var/run/prl_disp_service.socket with overly permissive 0777 permissions, making it accessible to any local process.
Compounding the problem, the PrlSrv_LoginLocal function also accepts unsigned clients. While peer credentials (peercred) are verified, there is no validation of the Apple Team ID. Consequently, attackers require neither an administrator account nor a signed Parallels application to interact with the service.
Exploitation occurs via command-line argument injection into the system command tar -xf "%1" -C "%2" using the --use-compress-program parameter. No active virtual machine needs to be running. Researchers demonstrated that a simple one-liner can write a NOPASSWD configuration into /etc/sudoers.d, immediately granting a root shell.
Threat to Shared Machines and Developer Systems
With root access, attackers can manipulate system files, bypass security mechanisms, access private data, and establish persistence via launchd services. Multi-user systems—such as those in universities, training labs, or corporate networks—are particularly at risk. Developer laptops utilizing package managers like Homebrew or npm are also potential targets for downstream exploitation. According to security observers, there are currently no known attacks in the wild.
Patch Status: Intel Macs Remain Unprotected for Now
The vendor resolved the vulnerability in Parallels Desktop 27.0.0 and subsequent build 27.0.1 (Build 58670). All versions prior to 27.0.0, including Parallels Desktop 26.4.0 (Build 57513), are affected.
However, owners of older hardware face a significant issue: Version 27 requires an Apple Silicon (M-series) Mac and at least macOS Sonoma 14.7. Users of Intel-based Macs cannot upgrade to version 27. Furthermore, the latest maintenance release for the previous version line, Parallels Desktop 26.4.2 (Build 57518), does not contain the security fix. As a result, Intel systems running version 26.x will remain vulnerable until the vendor provides a dedicated patch for that product branch.
Recommendations for Users
Users of Apple Silicon Macs should run the built-in update tool in Parallels Desktop immediately and verify that version 27.0.0 or later is installed. Anyone running Parallels Desktop on an Intel Mac shared with multiple users should revoke unprivileged account access or temporarily disable the software until Parallels releases a fix for the version 26 branch.
Sources: Borncity.com
