macOS Virtualization Software Exposes Root-Level Escalation Path
A high-severity vulnerability in Parallels Desktop for Mac could allow a low-privileged local user or malicious process to execute code with root privileges on the host system.
Tracked as CVE-2026-90894 and dubbed ParaShells by JFrog, the flaw was demonstrated on Parallels Desktop 26.4.0, build 57513, running on Apple silicon. JFrog rates the vulnerability CVSS 7.8.
The attack does not require administrator privileges, a running virtual machine, or a Parallels-signed application. An attacker only needs the ability to execute code locally as a normal user.
Root Service Becomes the Entry Point
The vulnerability centers onprl_disp_service, a privileged Parallels daemon that runs as root and handles operations including virtual appliance installation.
On affected systems, the service exposes a world-writable Unix socket at:
/var/run/prl_disp_service.socket
JFrog found that local clients could connect through the socket without requiring a Parallels-signed client or membership in the administrator group.
A Malformed Path Changes the Command
The exploitation chain reaches the appliance extraction function. Parallels constructs atarcommand using a path supplied by the local client and later parses that command with Qt'sQProcess::splitCommand.
A specially crafted quote in the appliance directory can break the intended argument structure and inject additionaltaroptions.
JFrog demonstrated abuse of--use-compress-program, causing a program controlled by the attacker to execute under the daemon's root context.
No VM Needs to Be Running
The attack is aimed at the macOS host, rather than the Windows or Linux virtual machines running inside Parallels.
That makes existing local execution particularly important. JFrog noted that a malicious Homebrew package, compromised build process or poisoned npm installation could provide the initial unprivileged code execution needed to chain into root access. Shared Macs with multiple local accounts also increase the relevance of the flaw.
Version 26 Creates a Patch Challenge
JFrog's advisory lists versions below 27.0.1 as affected. Parallels released Desktop 27.0.1 (build 58670) on September 1, 2026, while its official update notes describe the release as addressing stability and security issues.
The complication is Intel hardware.
Parallels Desktop 27 requires Apple silicon, while Intel Macs remain on the 26.x branch. Parallels says version 26 will continue receiving security and maintenance updates, but JFrog states that the relevant extraction change is not present in the 26.x line it examined.
What Administrators Should Check
Organizations should inventory Macs running Parallels Desktop and verify that Apple silicon systems have moved to a fixed release.
Until affected systems are updated, restricting unnecessary local accounts and monitoring suspicious activity aroundprl_disp_servicecan reduce exposure. A successful exploit can provide root access, allowing an attacker to modify system software, access other users' data or establish persistence.