Tia N.List

Reported by 3 outlets

Parallels Desktop Flaw Lets Unprivileged Mac Users Gain Root Access

hot0.0
Why this score
Breadth
1.50 / 2.0 · 3 sources
Authority
1.20 / 2.0 · best outlet weight
Severity
3.50 / 5.0 · CVSS + content signals
Velocity
0.00 / 2.0 · updates in 48h
Pickup speed
0.55 / 0.6 · time to second source
Recency
× 0.00 temporal multiplier
Community
+ 0.00 / 1.5 · reddit signal
Score
0.0 / 10 = base × recency + community
gbhackers.comvaltersit.comcyberpress.org CVE-2026-90894 first seen 27d ago

Analysis

CVE-2026-90894 affects Parallels Desktop. A local unprivileged macOS user can gain root via an unsanitized sVmParentPath parameter and tar injection in prl_disp_service, CVSS 7.8. Disclosed by JFrog researcher Yuval Moravchick; unpatched at time of report. Watch for a vendor fix and verify all macOS hosts running Parallels.

Timeline

  1. original reporting

    Parallels Desktop Flaw Lets Unprivileged Mac Users Gain Root Access

    gbhackers.com · 27d ago · September 16th, 2026

    A critical local privilege escalation vulnerability in Parallels Desktop could allow an unprivileged macOS user or a malicious process to gain root-level access to the host system. The issue, tracked as CVE-2026-90894, was disclosed by Yuval Moravchick from JFrog’s Vulnerability Research team and has been named “ParaShells.” This flaw was demonstrated against Parallels Desktop version […] The post Parallels Desktop Flaw Lets Unprivileged Mac Users Gain Root Access appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

  2. update from cyberpress.org

    Parallels Desktop Flaw Lets Unprivileged Mac Users Gain Root Access

    cyberpress.org · 27d ago · September 16th, 2026

    A critical local privilege-escalation vulnerability in Parallels Desktop for Mac could allow an unprivileged local user to execute attacker-controlled code with root privileges, placing developer workstations and shared macOS systems at risk. Tracked as CVE-2026-90894 and dubbed “ParaShells” by JFrog researchers, the flaw affects the privileged prl_disp_service daemon, which Parallels Desktop uses to manage virtual machines, networking components , and appliance installations. JFrog confirmed exploitation against Parallels Desktop 26.4.0 build 57513 on Apple Silicon systems. Parallels Desktop Flaw The issue is significant because exploitation does not require administrator rights, a signed Parallels client, or an active virtual machine. An attacker only needs code execution under a low-privileged local macOS account on a system where Parallels Desktop and its root-level dispatcher service are installed. Yuval Moravchick found that the service exposes the Unix socket /var/run/prl_disp_service.socket with world-writable permissions, allowing any local process to connect. The service’s PrlSrv_LoginLocal authentication path reportedly accepts requests based on local peer credentials rather than verifying that the connecting client is signed by Parallels. After authenticating to the service, an attacker can invoke the appliance-install feature and supply a malicious virtual-machine parent path . The vulnerable extraction flow constr

  3. update from www.valtersit.com

    CVE-2026-90894 Parallels Desktop: local root RCE via unsanitized sVmParentPath, tar injection in prl_disp_service. CVSS 7.8. Unpatched. Patc

    www.valtersit.com · 20d ago · September 23rd, 2026

    CVE-2026-90894 Parallels Desktop: local root RCE via unsanitized sVmParentPath, tar injection in prl_disp_service. CVSS 7.8. Unpatched. Patc

    via Mastodon https://www.valtersit.com/cve/CVE-2026-90894/

Source on GitHub