Local Privilege Escalation in Parallels Desktop for Mac (CVE‑2026‑90894) Grants Root to Any Local User

Local Privilege Escalation in Parallels Desktop for Mac (CVE‑2026‑90894) Grants Root to Any Local User

What It Is – A newly disclosed argument‑injection flaw (CVE‑2026‑90894, “ParaShells”) in Parallels Desktop for Mac v26.4.0 allows any low‑privileged local account to obtain root on the host.

Exploitability – Public proof‑of‑concept exists; the vulnerability is exploitable on any Mac with the vulnerable version installed and the prl_disp_service daemon running. No known active attacks, but the attack chain is short and requires only local code execution.

Affected Products – Parallels Desktop for Mac v26.4.0 (and possibly earlier builds) on macOS ARM devices. Fixed in Parallels Desktop v27.0.0 (released Sep 2026).

Why It Matters for Trust & Control Assurance

• Access‑control hygiene – The flaw bypasses least‑privilege safeguards by turning a world‑writable socket into a root escalation path, highlighting the need for continuous verification that privileged services are properly locked down.
• Patch‑management evidence – Demonstrating timely updates to virtualization software becomes a concrete audit artifact for control‑objective compliance across frameworks.
• Defensible audit trail – Logging of privileged‑service activity (e.g., prl_disp_service launches) provides the evidence needed to prove that unauthorized privilege escalation attempts were detected and contained.

Recommended Actions

1. Inventory every macOS endpoint running Parallels Desktop; record version and service status.
2. Upgrade all installations to Parallels Desktop v27.0.0 or later; verify the fix is applied.
3. If the virtualization service is not required, disable the prl_disp_service launch daemon and remove the associated Unix socket.
4. Harden local accounts: enforce least‑privilege policies, restrict write permissions on sockets, and enable multi‑factor authentication where possible.
5. Enable detailed logging for the daemon and monitor for anomalous socket activity.

Source: Help Net Security – Parallels Desktop flaw hands any local user root on a Mac (CVE‑2026‑90894)