Parallels Desktop Flaw Lets Non-Admin Mac Users Gain Root, but Intel Macs Can't Install Fix

Summary: JFrog reported this week that a flaw in Parallels Desktop for Mac lets an ordinary local account run code as root, tracked as CVE-2026-90894 and rated 7.8 out of 10, with the fix in Parallels Desktop 27, a version Intel Macs cannot install. The attack abuses the root-running prl_disp_service, whose socket was world-writable on the tested build, and a double quote in a chosen folder name that turns into a tar --use-compress-program option; JFrog demonstrated it on Parallels Desktop 26.4.0, build 57513, on Apple silicon.
Why it matters: Every Mac that stays on the 26.x line, including 26.4.2, lacks the fix according to JFrog, and Parallels has set no date for bringing it there, so Intel Macs have no build JFrog describes as repaired. JFrog also notes that an attacker who reaches root can hold a foothold through launchd that a product update would not clear.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-90894
Related: ⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, Click Fix Attacks, Click Fix Surge, and Browser Hijacks Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026