Parallels Desktop root flaw: Intel Macs have no patched version

Parallels Desktop has a vulnerability that allows a non-admin local account to run code as root, and the only version JFrog says contains the fix, Parallels Desktop 27, cannot be installed on Intel Macs. The flaw needs code already running on the machine as a normal user, so it does not work over the network. JFrog published the finding on Tuesday and calls it ParaShells. The flaw is tracked as CVE-2026-90894, an identifier JFrog assigned itself, and JFrog rates it 7.8 out of 10.

ParaShells is the name JFrog gave to this local privilege escalation. Yuval Moravchick, who leads JFrog's vulnerability research team, reported the discovery. Parallels Desktop is software that runs Windows and Linux inside virtual machines on a Mac. It installs a background service called prl_disp_service that runs as root because its work includes setting up host networking and unpacking virtual machine packages. The flaw is on the Mac side of the product, so the machine at risk is the Mac itself rather than the virtual machines on it. On the machine JFrog tested, the socket that the service listens on was world-writable, meaning any program on the Mac could connect to it. The login call that follows, PrlSrv_LoginLocal, checks only the credentials the kernel reports for the connecting process. It needs no Parallels code signature and works for an account that is not an administrator.

To install a virtual machine appliance, the service builds its unpack command as one line of text: tar -xf "%1" -C "%2". It then splits that text back into separate arguments using Qt's QProcess::splitCommand. The caller chooses part of that text, because it picks the folder the new virtual machine goes into. A double quote inside the folder name closes the quoting early, so whatever the attacker put after it becomes extra options for tar instead of part of a path. JFrog used the --use-compress-program option, which tells macOS tar to hand the archive to another program first. Because tar is running as root here, that program runs as root too. JFrog's test script wrote a passwordless sudo rule and opened a root shell.

JFrog demonstrated this on Parallels Desktop 26.4.0, build 57513, on a Mac with Apple silicon. It says a normal install already provides everything the attack needs: the product installed, the service running with its socket present, and a low-privileged local account. No virtual machine has to be running. The company did not check every build. It said: "We did not regression-test every older build for this writeup." Instead it told readers to treat any Desktop install that still exposes the same InstallAppliance extract template and world-writable dispatcher socket as in scope. JFrog also said the App Store edition may start its services differently, while describing the underlying risk as the same kind of problem. It reports no attacks using the flaw, and Parallels has published nothing about it. The reason a local flaw matters here, JFrog said, is that code running as a normal user is common on these machines. A malicious Homebrew formula, a poisoned npm install script, or a compromised build job would each qualify, as would one weak account on a shared lab or training Mac.

JFrog says the change that fixes the flaw is in Parallels Desktop 27. Its advisory lists everything below 27.0.0 as affected, its writeup names 27.0.0 as the fixed version, and the CVE record lists 27.0.0 as unaffected. The dates do not line up. JFrog's disclosure timeline gives 1 September 2026 as the day the fix shipped in 27.0.0, but Parallels' release notes put 27.0.0 on 25 August 2026 and 27.0.1 on 1 September 2026. Installing the newest release on that line, 27.0.1, build 58670, covers both readings. Parallels has not published a statement about CVE-2026-90894, so there is no vendor record indicating which build incorporates the change. Parallels says it does not discuss vulnerabilities until a fix has been released publicly. Its list of security fixes, which maps each flaw to the version that repairs it, has not been reviewed since May 2025 and does not include this one.

Parallels Desktop 27 needs a Mac with an Apple silicon chip. Its system requirements list Apple silicon only for the processor and macOS Sonoma 14.7 or newer for the operating system. On earlier releases of macOS, including Ventura 13, the installer sets up an older version of the product instead. Parallels removed Intel Mac support in version 27 and says the change follows Apple's plans rather than its own. macOS 26 Tahoe was the last version of macOS built for Intel Macs and macOS 27 is Apple silicon only, so a product built for macOS 27 cannot install on Intel hardware. Intel users are told to stay on Parallels Desktop 26. The company wrote on 25 August, three weeks before this flaw became public, that "Parallels Desktop 26 fully supports Intel-based Mac computers today, and that will not change," adding that Intel users can keep using version 26 and "expect future security and maintenance updates." That line does not have this fix, according to JFrog. Its advisory says: "Hosts that stay on the 26.x line, including 26.4.2, do not have that extract change." JFrog does not say it tested 26.4.1 or 26.4.2, and its writeup says it did not check older builds. Parallels' release notes for version 26 describe no such fix either. The newest build on that line, 26.4.2, came out on 8 September 2026, and its notes list one change, for a deployment problem in the Enterprise edition. Those notes are brief and usually state only that an update addresses overall stability and security issues, so they do not rule out a repair that was never documented. In summary, Parallels Desktop 27.0.1 (58670), released 1 September 2026, has the extract change per JFrog and can install only on Apple silicon Macs running macOS Sonoma 14.7 or newer. Parallels Desktop 26.4.2 (57518), released 8 September 2026, does not have that change per JFrog and can install on Intel and Apple silicon Macs. A Mac that cannot run version 27 therefore has no build that JFrog describes as fixed. Parallels has not said whether the change will reach version 26, and nothing it has published sets a date.

Two read-only commands show whether a Mac is exposed. The first reports the installed version: defaults read "/Applications/Parallels Desktop.app/Contents/Info" CFBundleShortVersionString. The second reports whether the service socket is open to every local process: ls -l /var/run/prl_disp_service.socket. JFrog says a socket showing srwxrwxrwx on a build at or near 26.4.0 should be treated as exposed until a patched build is confirmed. Both commands show exposure only, and neither shows whether anyone has used the flaw. Until every machine is on a fixed build, JFrog's advice is to limit who can log in locally, because any local account on a vulnerable install can reach the service. It also suggests listing every Mac in the organization that has Parallels Desktop on it. Administrators who push upd