Parallels Desktop for Mac has a flaw that lets an ordinary local account run code as root, the highest level of access on a Mac, software company JFrog said this week.
The attack needs code already running on the machine as a normal user, so it does not work over the network. JFrog says the fix is in Parallels Desktop 27, a version that Intel Macs cannot install.
Yuval Moravchick, who leads JFrog’s vulnerability research team, published the finding on Tuesday and calls it ParaShells. The flaw is tracked as CVE-2026-90894, an identifier JFrog assigned itself, and JFrog rates it 7.8 out of 10.
Parallels Desktop runs Windows and Linux inside virtual machines on a Mac. It installs a background service called prl_disp_service that runs as root, because its work includes setting up host networking and unpacking virtual machine packages.
The flaw is on the Mac side of the product, so the machine at risk is the Mac itself rather than the virtual machines on it.
On the machine JFrog tested, the socket that the service listens on was world-writable, meaning any program on the Mac could connect to it. The login call that follows, PrlSrv_LoginLocal, checks only the credentials the kernel reports for the connecting process. It needs no Parallels code signature and works for an account that is not an administrator.
To install a virtual machine appliance, the service builds its unpack command as one line of text, tar -xf “%1” -C “%2”. It then splits that text back into separate arguments using Qt’s QProcess::splitCommand.
The caller chooses part of that text, because it picks the folder the new virtual machine goes into. A double quote inside the folder name closes the quoting early, so whatever the attacker put after it becomes extra options for tar instead of part of a path.
The option JFrog used was –use-compress-program, which tells macOS tar to hand the archive to another program first. Because tar is running as root here, that program runs as root too. JFrog’s test script wrote a passwordless sudo rule and opened a root shell.
JFrog demonstrated this on Parallels Desktop 26.4.0, build 57513, on a Mac with an Apple silicon chip. It says a normal install already provides everything the attack needs: the product installed, the service running with its socket present, and a low-privileged local account. No virtual machine has to be running.
The company did not check every build. “We did not regression-test every older build for this writeup,” it said, telling readers instead: “Treat any Desktop install that still exposes the same InstallAppliance extract template and world-writable dispatcher socket as in scope.”
JFrog also said the App Store edition may start its services differently, while describing the underlying risk as the same kind of problem. It reports no attacks using the flaw, and Parallels has published nothing about it.
The reason a local flaw matters here, JFrog said, is that code running as a normal user is common on these machines. A malicious Homebrew formula, a poisoned npm install script, or a compromised build job would each qualify, as would one weak account on a shared lab or training Mac.
The Fix, and Which Build Has It
JFrog says the change that fixes the flaw is in Parallels Desktop 27. Its advisory lists everything below 27.0.0 as affected, its writeup names 27.0.0 as the fixed version, and the CVE record lists 27.0.0 as unaffected.
The dates do not line up. JFrog’s own disclosure timeline gives 1 September 2026 as the day the fix shipped in 27.0.0, but Parallels’ release notes put 27.0.0 on 25 August 2026 and 27.0.1 on 1 September 2026.
Installing the newest release on that line covers both readings, because 27.0.1, build 58670, shipped after both dates. Parallels has not published a statement about CVE-2026-90894, so there is no vendor record indicating which build incorporates the change.
Parallels says it does not discuss vulnerabilities until a fix has been released publicly. Its list of security fixes, which maps each flaw to the version that repairs it, has not been reviewed since May 2025 and does not include this one.
Who Cannot Install It
Parallels Desktop 27 needs a Mac with an Apple silicon chip. Its system requirements list Apple silicon only for the processor and macOS Sonoma 14.7 or newer for the operating system. On earlier releases of macOS, including Ventura 13, the installer sets up an older version of the product instead.
Parallels removed Intel Mac support in version 27 and says the change follows Apple’s plans rather than its own. macOS 26 Tahoe was the last version of macOS built for Intel Macs and macOS 27 is Apple silicon only, so a product built for macOS 27 cannot install on Intel hardware.
Intel users are told to stay on Parallels Desktop 26. “Parallels Desktop 26 fully supports Intel-based Mac computers today, and that will not change,” the company wrote on 25 August, three weeks before this flaw became public, adding that Intel users can keep using version 26 and “expect future security and maintenance updates.”
That line does not have this fix, according to JFrog. “Hosts that stay on the 26.x line, including 26.4.2, do not have that extract change,” its advisory says. JFrog does not say it tested 26.4.1 or 26.4.2, and its writeup says it did not check older builds.
Parallels’ release notes for version 26 describe no such fix either. The newest build on that line, 26.4.2, came out on 8 September 2026, and its notes list one change, for a deployment problem in the Enterprise edition.
Those notes are brief and usually state only that an update “addresses the overall stability and security issues,” so they do not rule out a repair that was never documented.
A Mac that cannot run version 27 therefore has no build that JFrog describes as fixed. Parallels has not said whether the change will reach version 26, and nothing it has published sets a date.
| Product line | Newest build | Has the extract change | Can install it |
|---|---|---|---|
| Parallels Desktop 27 | 27.0.1 (58670), 1 September 2026 | Yes, per JFrog, which names 27.0.0 | Apple silicon Macs on macOS Sonoma 14.7 or newer |
| Parallels Desktop 26 | 26.4.2 (57518), 8 September 2026 | No, per JFrog | Intel and Apple silicon Macs |
How to Check, and What to Do Now
Two read-only commands show whether a Mac is exposed. The first reports the installed version; the second reports whether the service socket is open to every local process.
- defaults read “/Applications/Parallels Desktop.app/Contents/Info” CFBundleShortVersionString
- ls -l /var/run/prl_disp_service.socket
JFrog says a socket showing srwxrwxrwx on a build at or near 26.4.0 should be treated as exposed until a patched build is confirmed. Both commands show exposure only, and neither shows whether anyone has used the flaw.
Until every machine is on a fixed build, JFrog’s advice is to limit who can log in locally, because any local account on a vulnerable install can reach the service. It also suggests listing every Mac in the organization that has Parallels Desktop on it.
Administrators who push updates through device management should check their version rules first. Parallels warns that a policy which sends out new major versions automatically will try to install version 27 on Intel Macs and fail, and it advises keeping those machines on version 26.
None of the published material says whether installing a fixed build removes access an attacker has already taken. JFrog notes that an attacker who reaches root can keep a foothold through launchd, which a product update would not clear.
