A Parallels bug hands any Mac user root, and Intel Macs cannot install the fix

Any user with a local account on a Mac running Parallels Desktop v26.4.0 can become root. There is no password prompt, no administrator group requirement, and no virtual machine needs to be running.

That is Parallels Desktop CVE-2026-90894, which the JFrog researcher who reported it nicknamed ParaShells. It affects Parallels Desktop for Mac v26.4.0 on Apple silicon, and the fix creates a second problem for anyone still running Intel hardware.

How the ParaShells chain works

The target is prl_disp_service, the privileged daemon Parallels uses to manage virtual machines, configure networking and install appliance packages. It runs as root because those jobs require it.

Three separate weaknesses stack. The daemon listens on a world writable Unix socket, so any local process can open a conversation with it. Local client authentication is weak enough that the daemon does not reliably establish who is calling. And appliance extraction passes attacker influenced values into a shell context, which is the argument injection step that turns that conversation into code execution.

Chain the three and a low privileged user gets arbitrary code running as root on the host. From there the usual consequences follow: replace system binaries, read every other user's home directory, and persist through launchd so the access survives a reboot.

Why this is worse than a normal local escalation

Local privilege escalation bugs usually come with conditions attached. You need a virtual machine running, or the Parallels client open, or membership in a group that already implies partial trust. ParaShells has none of those. The prerequisites are a local account and the vulnerable version installed.

That matters because of where Parallels tends to live. Shared lab machines, contractor laptops and managed corporate fleets running Windows software on Mac hardware all fit the profile, and those are the environments where a second local account looks normal rather than suspicious. The same reasoning applied to the KVM Januscape hypervisor escape: virtualisation software sits at a trust boundary that most asset inventories do not model.

The Intel Mac problem

Alludo fixed the chain in Parallels Desktop v27.0.0, released at the start of September. For Apple silicon Macs that is the whole remediation, and it is enough.

Version 27 does not install on Intel Macs. Apple stopped selling Intel hardware years ago, but 2019 and 2020 machines are still in rotation across plenty of fleets, and Parallels was one of the reasons those machines were bought in the first place. For those users, update to v27 is not advice. The real options are removing Parallels, keeping it and accepting a documented local root path, or replacing the hardware.

What to check today

• Parallels version: Parallels Desktop menu, then About Parallels Desktop.
• Processor type: Apple menu, then About This Mac.
• Apple silicon below v27.0.0: update now.
• Intel: no patch exists for this hardware. Treat the machine as carrying a known local root path and decide whether Parallels stays installed.
• Audit who holds local accounts on shared machines, the same way you would after any vendor patch batch.

Most vulnerability coverage ends at the version number. This one does not resolve that cleanly, and it follows a pattern worth noting alongside the Cisco email gateway flaw from earlier this week: the patch exists, and a real share of affected machines still cannot take it. The part worth sitting with is how long v26 stays supported on Intel, because that decision sets the shelf life of every Intel Mac with Parallels on it.