Parallels Desktop Flaw Lets Local Users Gain Root, Leaving Intel Macs Without a Patch

The Flaw and How Local Code Becomes Root

JFrog's vulnerability research team, led by Yuval Moravchick, disclosed a local privilege-escalation flaw in Parallels Desktop for Mac that lets any non-administrator local account run code as root. Tracked as CVE-2026-90894 and nicknamed ParaShells, the issue carries a CVSS score of 7.8 and requires an attacker to already have code executing on the Mac as a normal user; it cannot be triggered remotely. The flaw sits inside Parallels' background prl_disp_service, which runs as root to manage host networking and unpack virtual machine packages. On tested builds, the service listens on a world-writable socket at /var/run/prl_disp_service.socket, allowing any local process to connect. The subsequent PrlSrv_LoginLocal routine validates only the kernel-reported credentials of the connecting process, demands no Parallels code signature, and accepts non-administrator accounts.

From Folder Name to Root Shell

When installing a virtual appliance, prl_disp_service builds its tar command as a single string, `tar -xf "%1" -C "%2"`, and then splits it back into arguments using Qt's `QProcess::splitCommand`. The caller controls part of that text by choosing the destination folder for the new virtual machine. A double quote embedded in the folder name closes the quoting early, turning the text that follows into extra tar options rather than a path component. JFrog exploited that behavior with `--use-compress-program`, which instructs macOS tar to hand the archive to another program first; because tar is running as root, that auxiliary program runs as root too. JFrog's test script used that capability to write a passwordless sudo rule and open a root shell. The researchers reproduced the attack on Parallels Desktop 26.4.0, build 57513, on a Mac with an Apple silicon chip, and noted that a standard install supplies everything required: the product, the running service, the exposed socket, and a low-privileged local account. No virtual machine needs to be running.

The Fix Lives in Parallels Desktop 27

JFrog's advisory lists every build below 27.0.0 as affected, names 27.0.0 as the fixed version, and the CVE record also lists 27.0.0 as unaffected. JFrog's disclosure timeline lists September 1, 2026 as the day the fix shipped in 27.0.0, while Parallels' own release notes place 27.0.0 on August 25, 2026 and 27.0.1 on September 1, 2026. Installing the newest release on that line, 27.0.1, build 58670, covers both readings. JFrog did not regression-test every older build and advises readers to "treat any Desktop install that still exposes the same InstallAppliance extract template and world-writable dispatcher socket as in scope." The App Store edition may start its services differently, though JFrog characterizes the underlying risk as the same class of problem. No exploitation in the wild has been reported, and Parallels has not published a public statement on CVE-2026-90894.

Intel Macs Are Stuck on Parallels Desktop 26

Parallels Desktop 27 requires Apple silicon and macOS Sonoma 14.7 or later. The installer falls back to an older version on earlier macOS releases, including Ventura 13. Parallels removed Intel support in version 27, citing Apple's transition away from the architecture; macOS 26 Tahoe was the last release to support Intel Macs, and macOS 27 is Apple silicon only. Intel users therefore remain on version 26 and cannot install the patched build. In an August 25, 2026 statement, Parallels said that "Parallels Desktop 26 supports Intel-based Mac computers today, and that will not change," adding that users can "expect future security and maintenance updates," though that line does not include the ParaShells repair.

Attack Surface Beyond a Curious Insider

JFrog emphasized that the local-only nature of the flaw does not make it theoretical on shared or developer machines. A malicious Homebrew formula, a poisoned npm install script, or a compromised build job can all provide the initial local execution needed to trigger the bug, as can a single weak account on a shared lab or training Mac. The fix remains out of reach for Intel Mac users until Parallels either backports the repair to version 26 or extends support to cover the unpatched line.