jfrog.com Parallels Desktop Vulnerability Allows Local Users to Gain Root Access
Article Content
- •CVE-2026-90894 allows local users to gain root access on vulnerable Macs.
- •The vulnerability affects Parallels Desktop 26.4.0 and potentially older versions.
- •A patch is available in version 27.0.0, but Intel Macs cannot apply it.
A critical vulnerability in Parallels Desktop, identified as CVE-2026-90894 and dubbed 'ParaShells', allows any local user on a Mac to execute code with root privileges. The flaw arises from a world-writable Unix socket and weak local-client authentication in the prl_disp_service, which runs as root. This vulnerability affects Parallels Desktop version 26.4.0 (build 57513) and potentially older versions. The exploit requires a low-privileged local account and does not necessitate a running virtual machine. JFrog, which discovered the flaw, has rated it 7.8 out of 10 in severity. A patch is available in Parallels Desktop version 27.0.0, but Intel Macs cannot install this fix. Organizations are advised to identify affected systems and restrict local accounts until they can upgrade. No active exploitation has been reported yet.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (5)
Following this threat?
Track HBO Max and CVE-2026-76461 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical Cisco Secure Email Gateway Vulnerability Exploited Cisco has disclosed a critical vulnerability in its Secure Email Gateway (SEG), tracked as CVE-2026-76519, which allows unauthenticated remote attackers to execute commands with root privileges. This flaw arises from improper handling of email attachments when the File Reputation service is enabled. Active… 
High-Risk Command Injection Vulnerabilities in Red Hat Satellite Two command injection vulnerabilities (CVE-2026-12540 and CVE-2026-12541) were discovered in Red Hat Satellite's Foreman component, affecting the foreman-rake tasks. These flaws allow attackers with sudo permissions to execute arbitrary code by injecting shell metacharacters into system commands. The vulnerabilities…