As reported by The Hacker News, JFrog disclosed CVE-2026-90894 this week—a local privilege escalation flaw in Parallels Desktop for Mac that allows any non-administrative local account to execute code as root. The vulnerability, which JFrog has dubbed "ParaShells," carries a CVSS score of 7.8 (High) and was demonstrated on Parallels Desktop 26.4.0. The fix ships in Parallels Desktop 27, but here is the critical problem: that version does not support Intel-based Macs.

Security Impact: The vulnerability, which JFrog has dubbed "ParaShells," carries a CVSS score of 7.8 (High) and was demonstrated on Parallels Desktop 26.4.0.

CVECVSSSeverityAffectedPatchExploited in Wild
CVE-2026-908947.8HighParallels Desktop ≤ 26.x (likely all builds with vulnerable InstallAppliance + world-writable socket)Parallels Desktop 27+ (Apple silicon only)No public evidence yet

Why This Matters More Than a Typical LPE

Local privilege escalation vulnerabilities are common, but several factors make this one stand out—and not in a good way.

The Intel Mac Remediation Gap

The most consequential issue is not the vulnerability itself but the remediation path. Parallels Desktop 27 requires Apple silicon, meaning every Intel Mac running Parallels is now running on software with a known root escalation primitive and no vendor-supplied fix. Intel Macs were sold as recently as 2020 and remain common in enterprise fleets, education environments, and developer workstations that rely on x86 virtualization. These are exactly the environments where Parallels sees heavy use, and they are now permanently exposed unless Parallels backports the fix or organizations take compensating measures.

This is a textbook example of a vendor creating a security debt cliff: the only remediation is a product upgrade that a significant portion of the installed base cannot perform.

The Attack Chain Is Elegant and Reliable

JFrog's writeup describes a clean multi-stage chain that requires no exotic conditions:

Why This Matters More Than a Typical LPE
World-writable dispatcher socket: The prl_disp_service root daemon listens on a Unix socket that any local process can connect to—no authentication boundary at the transport layer.
No code signature verification: The PrlSrv_LoginLocal call trusts kernel-reported credentials only. It does not verify that the connecting process is signed by Parallels, so any local binary can authenticate.
Argument injection via Qt splitting: The appliance install path uses QProcess::splitCommand to reparse a tar command string. An attacker-controlled directory name containing a double quote breaks out of the quoted argument, injecting --use-compress-program to execute arbitrary code in the root context.

No virtual machine needs to be running. A default install with the service active is sufficient. This lowers the bar significantly—any malware or implant that achieves standard user execution on a Parallels-equipped Mac can immediately pivot to full root.

Who Is Most at Risk

  • Intel Mac fleets in enterprise and education: No patch available, high likelihood of Parallels usage for legacy Windows/x86 workloads.
  • Shared or multi-user Mac workstations: Labs, classrooms, and development servers where multiple non-admin accounts coexist.
  • Environments where endpoint detection on macOS is weak: Organizations without robust macOS EDR will struggle to spot the socket connection or the anomalous root-spawned process.
  • Supply chain and developer machines: A root compromise on a developer's Mac can lead to source code theft, build pipeline tampering, or credential exfiltration from keychains and SSH agents.

Shield53 Recommendations

Immediate Actions

  • Upgrade to Parallels Desktop 27 on all Apple silicon Macs. This is the only vendor-supported fix. Prioritize systems with multiple local user accounts.
  • For Intel Macs, evaluate whether Parallels can be removed entirely. If x86 virtualization is required, consider migrating to alternative hypervisors or replacing the hardware. If removal is not possible, apply compensating controls below.
  • Restrict the prl_disp_service socket permissions. If feasible, modify the socket ownership or permissions to limit which users can connect. Test thoroughly before deploying, as this may affect Parallels functionality.
  • Enforce least-privilege local accounts. Reduce the number of non-admin accounts on Parallels-equipped Macs. Where multi-user access is required, consider managed guest accounts that are reset on logout.

Detection Guidance

  • Monitor for connections to the Parallels dispatcher socket from processes not signed by Parallels or Alludo.
  • Alert on tar executions with --use-compress-program flags, especially when spawned by prl_disp_service or running with root privileges.
  • Watch for modifications to /etc/sudoers or /etc/sudoers.d/ following Parallels service activity—JFrog's PoC writes a passwordless sudo rule as its persistence mechanism.
  • Log process parent-child relationships: any root process spawned by prl_disp_service outside of known VM lifecycle events warrants investigation.

Strategic Actions

  • Audit your Mac fleet for Parallels installations and flag all Intel-based systems as carrying unpatched risk. Track this as an open risk in your vulnerability management program.
  • Pressure vendors for backported patches. When a vendor drops platform support mid-disclosure, the CVE does not disappear. File support requests demanding a 26.x patch for Intel systems.
  • Accelerate Intel Mac retirement plans. This vulnerability is one of many that will accumulate as vendors shift to Apple silicon–only releases. Use this as a business case for hardware refresh.

Broader Implications

The Parallels situation illustrates a growing problem in the macOS ecosystem: as vendors consolidate on Apple silicon, Intel Macs are becoming second-class citizens for security patching. Organizations that treat Mac hardware refresh as a convenience issue rather than a security posture issue are accumulating silent risk. CVE-2026-90894 will not be the last vulnerability where the fix arrives on a platform that a chunk of the fleet cannot run.

Additionally, the argument injection vector JFrog identified—trusting QProcess::splitCommand to safely reparse a shell-style command string—is a pattern that likely exists in other macOS and cross-platform applications. Security teams and developers should audit their own codebases for similar patterns where user-controlled input flows into command strings that are later re-tokenized.