Threat Intelligence

Parallels Desktop Bug Lets Standard Mac Users Grab Root Access, No Fix Yet for Intel Macs

The Hacker News · 16 Sept 2026

Key Takeaway Businesses running Parallels Desktop on Intel Macs should limit who has local access to affected machines and watch for an official fix or workaround from Parallels.

Security researchers at JFrog have disclosed a vulnerability in Parallels Desktop for Mac, the popular tool for running Windows and Linux virtual machines on macOS. Dubbed ParaShells and tracked as CVE-2026-90894, the flaw allows any ordinary local account on a Mac, without administrator rights, to escalate to root, the highest level of system access.

The issue lies in a background service called prl_disp_service, which normally runs as root to handle tasks like networking setup and unpacking virtual machine files. JFrog found that the service's communication socket was open to any program on the Mac, and its login check relied only on basic process credentials rather than any Parallels-specific verification. By exploiting how the service builds and processes a file-extraction command, researchers were able to inject extra instructions that ran with root privileges, ultimately opening a fully privileged root shell. Importantly, the attack requires code already running on the Mac itself; it cannot be launched remotely over a network, and no virtual machine needs to be active for it to work.

JFrog rates the flaw 7.8 out of 10 in severity and says it has been fixed in Parallels Desktop 27. However, that version cannot be installed on Intel-based Macs, leaving those systems without an available patch at this time.

Parallels Desktop macOS Security Privilege Escalation Vulnerability Disclosure JFrog

Summarised by CISO AI from The Hacker News. We link back to every original so you can read it yourself.