CVE-2026-90894Patch

HIGHCVSS 7.8 · HIGH

Exploitation observed; activity peaked at 12 mentions and remains active

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Parallels Desktop runs prl_disp_service as root. Local clients reach it on the world-writable socket /var/run/prl_disp_service.socket. PrlSrv_LoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrv_InstallAppliance lets you pick the appliance folder (sVmParentPath). The daemon unpacks with one string, tar -xf "%1" -C "%2", then Qt QProcess::splitCommand chops that string into words. A quote in the folder name closes early. The leftover text becomes extra tar flags. macOS tar --use-compress-program= runs the named program as root.

Back to dashboard

7.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-78CWE-88CWE-269

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Threat summary

Active exploitation appears in 1 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
20 mentions across 6 observed days

What's happening

Active exploitation reported across 1 signal
Exploit tool or code specified in 1 signal
PoC mentioned or linked in 3 signals
Patch or workaround mentioned in 13 signals
Technical details provided in 18 signals
Disclosure: 4 classified signals
Peaked 4d ago at 12 mentions (2026-09-16); latest day: 1
20 total mentions across 6 days

Deep dive

Activity timeline20 mentions / 6d

Signal classification6 categories

Patch

1050.0%

Disclosure

420.0%

PoC

315.0%

Exploit

15.0%

Active Exploitation

15.0%

General

15.0%

Referenced assets15 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-15	2	Exploit1PoC1
2026-09-16	12	Active Exploitation1Disclosure3Patch7PoC1
2026-09-17	2	Disclosure1General1
2026-09-18	2	Patch1PoC1
2026-09-23	1	Patch1
2026-09-25	1	Patch1

Full discourse20 posts

The Hacker News@TheHackersNews45d
Patch
🛑 A Parallels Desktop flaw lets non-admin Mac users gain root, but Intel Macs can’t install the version containing the fix. Tracked as CVE-2026-90894, JFrog demonstrated the flaw on Parallels Desktop 26.4.0 and reports no attacks. How the root escalation works → https://thehackernews.com/2026/09/parallels-desktop-flaw-lets-non-admin.html
Post summary
The tweet reports CVE-2026-90894, describing a root‑escalation flaw in Parallels Desktop that is fixed in version 26.4.0, with no active exploitation observed.
3111883129.2K
2.4M followersView on X
JFrog Security@JFrogSecurity45d
Patch
🚨 Parallels Desktop runs as root, and that can be exploited now! 🚨 Our team discovered a 0-day LPE vulnerability: CVE-2026-90894. Any local user can gain root access, no need for admin group. Fix immediately by upgrading to version 27.0.0. Full technical details on our blog >> https://research.jfrog.com/vulnerabilities/parallels-desktop-is-vulnerable-to-a-local-privilege-escalation-via-appliance-extract-argument-injection-cve-2026-90894/
Post summary
The text reports a local privilege escalation vulnerability in Parallels Desktop and directs users to upgrade to version 27.0.0. It provides some technical detail but does not mention PoC code, a named exploit tool, active exploitation, or debunking.
112031112.3K
5.6K followersView on X
DFIR Radar@DFIR_Radar46d
PoC
CVE-2026-90894: Parallels Desktop local privilege escalation lets any unprivileged macOS user reach root via argument injection into a world-writable IPC socket. Fixed in Desktop 27.0.0. Key details: - CVE-2026-90894 affects Parallels Desktop 26.4.0 (build 57513) on macOS arm64. The root helper prl_disp_service runs as uid 0 and exposes /var/run/prl_disp_service.socket at mode 0777, meaning any local process can connect. PrlSrv_LoginLocal authenticates via peercred only, with no Parallels Team ID check, so an unsigned script from a non-admin account logs in successfully. - The exploit chain: attacker calls InstallAppliance with a sVmParentPath containing an embedded quote, e.g. /tmp/sprl_p_505" --use-compress-program=/tmp/u505 ". Qt's QProcess::splitCommand treats the quote as syntax, not a filename character, rewriting the tar argv to include --use-compress-program=/tmp/u505. Because prl_disp_service launches tar as root, the attacker's compress-program script runs as uid 0. No VM needs to be running. - Post-exploitation: the PoC script writes a NOPASSWD sudoers fragment to /etc/sudoers.d/ and opens an interactive root shell. A failed appliance extract error (-41508) is the only visible anomaly after the payload runs. - Attack surface is broad. Parallels is common on developer laptops. A malicious Homebrew formula, poisoned npm preinstall, or browser download landing as a low-privileged user gains a clean path to root if Desktop is installed. #DFIR_Radar
Post summary
CVE-2026-90894 is a local privilege escalation vulnerability in Parallels Desktop allowing any unprivileged macOS user to reach root via argument injection into a world-writable IPC socket. A PoC script is described that exploits the vulnerability to create a NOPASSWD sudoers entry and spawn a root shell, with the fix available in Desktop 27.0.0.
12112430
1.9K followersView on X
kokumօtօ@__kokumoto44d
PoC
Parallels Desktop for Macに権限昇格の脆弱性。"ParaShells"ことCVE-2026-90894はCVSSスコア7.8で、ローカルユーザーがMacのrootを取得可能。PoC（攻撃の概念実証コード）公開済み。バージョン27.0.0で修正。 https://thecyberexpress.com/parallels-desktop-parashells-cve-2026-90894/amp/
Post summary
The post discloses a local privilege escalation vulnerability in Parallels Desktop for Mac (CVE-2026-90894, CVSS 7.8), notes that a proof‑of‑concept exploit has been published, and states the issue is fixed in version 27.0.0.
00031847
7.8K followersView on X
Cybersecurity News Everyday@TweetThreatNews45d
Patch
JFrog disclosed CVE-2026-90894, a Parallels Desktop flaw on Apple ARM Macs that lets any local user escalate to root via argument injection in appliance extraction. Fixed in v27.0.0. #ParaShells #ParallelsDesktop #Alludo https://www.hendryadrian.com/parallels-desktop-flaw-hands-any-local-user-root-on-a-mac-cve-2026-90894/
Post summary
The tweet announces JFrog's disclosure of CVE-2026-90894, a local privilege escalation flaw in Parallels Desktop for Apple ARM Macs, and highlights that the issue is fixed in version 27.0.0.
00011356
4.8K followersView on X
iototsecnews@iototsecnews37d
Patch
Parallels Desktop の脆弱性 CVE-2026-90894：パッチ提供前の root アクセス阻止のために https://iototsecnews.jp/2026/09/16/parallels-desktop-flaw-lets-unprivileged-mac-users-gain-root-access/ この記事は、Parallels Desktop に存在する深刻な脆弱性 CVE-2026-90894 について解説するものです。この問題の背景には、root 権限で機能するデーモンにおける Unix ドメインソケットのアクセス制御不備や認証の脆弱性、およびアーカイブ展開コマンド生成時の引数インジェクションが存在します。悪用された場合の影響として、低権限のローカルユーザーによる外部プログラムの実行／ホストシステムでの root 権限奪取／システム全体の掌握が挙げられます。対応策としては、影響を受ける稼働環境の把握／Unix ドメインソケットのアクセス権限チェック／最新パッチ適用／不審な処理やファイル変更の監視が求められます。 #CVE202690894 #Desktop #Parallels #Vulnerability
Post summary
The article describes CVE-2026-90894 in Parallels Desktop, which allows low-privilege mac users to gain root via Unix domain socket misconfigurations and argument injection, and urges applying the latest patch and checking socket permissions as mitigation.
00010116
516 followersView on X
JFrog@jfrog45d
Patch
🚨 Parallels Desktop runs as root, and that can be exploited now! 🚨 Full technical details on our blog: https://bit.ly/4xRGpWu Our team discovered a 0-day LPE vulnerability: CVE-2026-90894. Any local user can gain root access, no need for admin group. Fix immediately by upgrading to version 27.0.0.
Post summary
The announcement describes a local privilege escalation vulnerability in Parallels Desktop and provides a specific version upgrade as the fix.
00001729
23.3K followersView on X
The Cyber Security Hub™@TheCyberSecHub45d
Disclosure
Parallels Desktop flaw hands any local user root on a Mac (CVE-2026-90894) https://www.helpnetsecurity.com/2026/09/16/parallels-desktop-cve-2026-90894-parashells-vulnerability/?utm_source=dlvr.it&utm_medium=twitter
Post summary
The text announces CVE-2026-90894 in Parallels Desktop and highlights that a local user can gain root on a Mac. It does not mention PoC code, named exploit tools, active exploitation, or remediation.
000101.4K
195.2K followersView on X
Help Net Security@helpnetsecurity45d
PoC
Parallels Desktop flaw hands any local user root on a Mac (CVE-2026-90894) - https://www.helpnetsecurity.com/2026/09/16/parallels-desktop-cve-2026-90894-parashells-vulnerability/ - @jfrog #Exploit #macOS #PoC #Virtualization #Cybersecurity #CyberSecurityNews #SecurityNews https://t.co/FmLElKmMcg
Post summary
The post identifies CVE-2026-90894 as a macOS local privilege-escalation flaw that can give a local user root access and includes a #PoC hashtag. It provides no exploit code, active exploitation report, or remediation details.
10000668
60.2K followersView on X
JFrog@jfrog46d
Exploit
👉🏽 New JFrog #Security Research: ParaShells (CVE-2026-90894) A vulnerability in Parallels Desktop for Mac allows a standard, non-admin local user to escalate privileges to root in seconds. 🤯 The exploit uses argument injection against macOS tar via a world-writable Unix socket managed by the prl_disp_service daemon. If you manage Macs with Parallels installed, inventory your fleet and update to version 27.0.0 immediately. 🛑 ✅ Read the full technical deep dive on the JFrog blog: https://bit.ly/4y29ONY #MacOS #Cybersecurity #PrivilegeEscalation #Parallels #VulnerabilityResearch
Post summary
The tweet discloses a JFrog research finding for CVE-2026-90894, describing an argument-injection privilege-escalation exploit against Parallels Desktop for Mac and advising an immediate update to version 27.0.0.
00001399
23.3K followersView on X
Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters38d
Patch
CVE-2026-90894 Parallels Desktop: local root RCE via unsanitized sVmParentPath, tar injection in prl_disp_service. CVSS 7.8. Unpatched. Patch or restrict socket access now. https://www.valtersit.com/cve/CVE-2026-90894 #CVE #infosec #Parallels #Parallels #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker
Post summary
The tweet describes CVE-2026-90894 as an unpatched local root RCE in Parallels Desktop via tar injection (CVSS 7.8) and advises users to patch or restrict socket access.
0000068
1.1K followersView on X
BT Haberler@BTHaberler43d
Patch
"ParaShells" Adlı Açık, Parallels Desktop'ta Yönetici Olmayan Mac Kullanıcılarının Root Yetkisi Kazanmasına İzin Veriyor! JFrog araştırmacısı Yuval Moravchick'in keşfettiği ve "ParaShells" adını verdiği CVE-2026-90894 (CVSS 7.8), Parallels Desktop for Mac'in root yetkisiyle çalışan arka plan servisinin (prl_disp_service) kullandığı bir socket'in herkes tarafından yazılabilir olmasından kaynaklanıyor; saldırgan, sanal makine kurulum komutundaki tırnak işaretlerini kötüye kullanarak tar komutuna seçenek enjekte edip root erişimi kazanabiliyor. • Açık, yerel ağ erişimi gerektirse de Homebrew formülleri veya npm script'leri gibi sık kullanılan araçlar üzerinden de tetiklenebiliyor. • Sorun Parallels Desktop 27 sürümünde düzeltildi, ancak Intel tabanlı Mac'ler bu sürümü yükleyemediği için kalıcı bir çözüme kavuşamıyor. Bir donanım geçiş sınırlamasının (Intel Mac'lerin yeni sürümü alamaması) bir güvenlik açığını kalıcı hale getirebilmesi, yazılım desteğinin sona ermesinin sadece özellik kaybı değil, çözümsüz güvenlik riski de anlamına gelebileceğini gösteriyor. #SiberGüvenlik #Parallels #macOS
Post summary
The post discloses the 'ParaShells' vulnerability (CVE-2026-90894) in Parallels Desktop for Mac, detailing a local privilege escalation flaw, and notes that it has been patched in version 27, though Intel-based Macs cannot receive the fix.
0000070
44 followersView on X
Ryan Merck@rmerck44d
Disclosure
Calling Parallels a niche laptop tool is how fleets miss this. CVE-2026-90894 needs no running VM and elevates any local Mac user to host root. The install alone was the privilege boundary. https://www.helpnetsecurity.com/2026/09/16/parallels-desktop-cve-2026-90894/
Post summary
The post discloses CVE-2026-90894 in Parallels Desktop, detailing a local privilege escalation to root that requires no running VM, and references a Help Net Security article for further information.
0000047
46 followersView on X
Tony Cleal CISSP, SSCP, CISA, CISM, GCIH@tony_cleal44d
General
https://www.helpnetsecurity.com/2026/09/16/parallels-desktop-cve-2026-90894-parashells-vulnerability/
Post summary
The input text is solely a URL pointing to a Help Net Security article regarding CVE-2026-90894 (ParaShells) in Parallels Desktop. No article content, technical details, exploitation status, or remediation information is present in the provided text to support a more specific classification.
0000048
1.0K followersView on X
Swif@swif_ai45d
Patch
Parallels Desktop ran root via a world-writable socket; a quoting bug let local non-admins get root (CVE-2026-90894, CVSS 7.8). Fixed in v27-Intel Macs cant install it. MDM policy must gate updates by chip type. https://thehackernews.com/2026/09/parallels-desktop-flaw-lets-non-admin.html
Post summary
The text discloses a local privilege escalation vulnerability in Parallels Desktop (CVE-2026-90894, CVSS 7.8) caused by a world-writable socket and quoting bug, and notes a fix in version 27, though Intel Macs cannot install it, requiring MDM policy gating by chip type.
0000056
63 followersView on X
Aviatrix Threat Research Center@aviatrixtrc45d
Active Exploitation
TRC analysis shows attackers exploiting CVE-2026-90894 in Parallels Desktop to escalate from normal user to root privileges through command injection. The 'ParaShells' vulnerability demonstrates how virtualization software can become an unexpected privilege escalation pathway in Mac environments. #Vulnerability 🔗 Full breakdown: https://aviatrix.ai/threat-research-center/parallels-desktop-flaw-lets-non-admin-mac-users-gain-root-cve-2026-90894
Post summary
The tweet reports that attackers are actively exploiting CVE-2026-90894 in Parallels Desktop via command injection to gain root privileges, providing technical details but no patch or PoC information.
0000057
2.0K followersView on X
NEXSIGHT@NEXSIGHTNEWS45d
Patch
Parallels Desktopに非管理者からroot権限を奪う脆弱性「ParaShells」— JFrogが公表、修正は27.0.0で提供（CVE-2026-90894） https://cyber.nexsight.co/articles/2026/09/16/parallels-desktop-parashells-cve-2026-90894-local-privilege-escalation-2026-09-16/
Post summary
JFrog disclosed a local privilege escalation vulnerability (ParaShells, CVE‑2026‑90894) in Parallels Desktop and noted that version 27.0.0 contains a patch addressing the issue.
0000068
71 followersView on X
Undercode News@undercode_news45d
Disclosure
🚨 Parallels Desktop Root Access Flaw Puts Mac Hosts at Risk: What Users Need to Know About #CVE-2026-90894 + Video -Fact Checker: ✅: 3 ❌: 3 || 3/6 → Score: 50% ⚖️ -Prediction: 📈 7 Positive | 📉 0 Negative https://undercodenews.com/parallels-desktop-root-access-flaw-puts-mac-hosts-at-risk-what-users-need-to-know-about-cve-2026-90894-video/
Post summary
The tweet announces CVE‑2026‑90894, a root‑access flaw in Parallels Desktop for Mac, and shares a link to an article for further information, without providing PoC, exploit, patch, or active exploitation details.
0000037
122 followersView on X
Shah Sheikh@shah_sheikh45d
Disclosure
Parallels Desktop flaw hands any local user root on a Mac (CVE-2026-90894): A newly disclosed vulnerability in Parallels Desktop, tracked as CVE-2026-90894 and dubbed “ParaShells,” can allow any local user on a Mac to gain root privileges on the host… https://www.helpnetsecurity.com/2026/09/16/parallels-desktop-cve-2026-90894-parashells-vulnerability/?utm_source=dlvr.it&utm_medium=twitter https://t.co/O8mSIj8diM
Post summary
The tweet announces a newly disclosed privilege escalation vulnerability (CVE-2026-90894 'ParaShells') in Parallels Desktop allowing local users to gain root on Mac, with links to a news article but no PoC, exploit, or patch information.
0000049
2.3K followersView on X
The Daily Tech Feed@dailytechonx45d
Patch
Major security alert: CVE-2026-90894 “ParaShells” in Parallels Desktop allows non-admin Mac users to execute root-level code via prl_disp_service. Key issues: world-writable socket, weak authentication, and argument injection during appliance install. Apple Silicon machines running build 57513 are exposed. Upgrade to 27.0.0 or later ASAP and restrict access until patched. #Security #MacOS #Parallels #PrivilegeEscalation #Security #MacOS #Parallels #Vulnerability #PrivilegeEscalation #PatchNow https://thedailytechfeed.com/parashells-flaw-lets-mac-users-elevate-privileges-in-parallels-desktop/
Post summary
The text discloses CVE-2026-90894 ('ParaShells'), a privilege escalation vulnerability in Parallels Desktop with detailed technical characteristics (world-writable socket, argument injection via prl_disp_service), and explicitly recommends upgrading to version 27.0.0 or later as the primary remediation action.
0000074
737 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-90894

JFrog Security[verified]@JFrogSecurityPatch

The text reports a local privilege escalation vulnerability in Parallels Desktop and directs users to upgrade to version 27.0.0. It provides some technical detail but does not mention PoC code, a named exploit tool, active exploitation, or debunking.

DFIR Radar[verified]@DFIR_RadarPoC

CVE-2026-90894 is a local privilege escalation vulnerability in Parallels Desktop allowing any unprivileged macOS user to reach root via argument injection into a world-writable IPC socket. A PoC script is described that exploits the vulnerability to create a NOPASSWD sudoers entry and spawn a root shell, with the fix available in Desktop 27.0.0.

kokumօtօ[verified]@__kokumotoPoC

The post discloses a local privilege escalation vulnerability in Parallels Desktop for Mac (CVE-2026-90894, CVSS 7.8), notes that a proof‑of‑concept exploit has been published, and states the issue is fixed in version 27.0.0.

Cybersecurity News Everyday[verified]@TweetThreatNewsPatch

The tweet announces JFrog's disclosure of CVE-2026-90894, a local privilege escalation flaw in Parallels Desktop for Apple ARM Macs, and highlights that the issue is fixed in version 27.0.0.

JFrog[verified]@jfrogPatch

The announcement describes a local privilege escalation vulnerability in Parallels Desktop and provides a specific version upgrade as the fix.

The Cyber Security Hub™[verified]@TheCyberSecHubDisclosure

The text announces CVE-2026-90894 in Parallels Desktop and highlights that a local user can gain root on a Mac. It does not mention PoC code, named exploit tools, active exploitation, or remediation.

JFrog[verified]@jfrogExploit

The tweet discloses a JFrog research finding for CVE-2026-90894, describing an argument-injection privilege-escalation exploit against Parallels Desktop for Mac and advising an immediate update to version 27.0.0.

Hugo | DevOps | Cybersecurity 🇱🇻[verified]@HugoValtersPatch

The tweet describes CVE-2026-90894 as an unpatched local root RCE in Parallels Desktop via tar injection (CVSS 7.8) and advises users to patch or restrict socket access.