Ethical Hacking News
Parallels Desktop, a popular virtualization software for Mac users, has been found to have a critical vulnerability that allows non-administrative users to gain root access. The vulnerability, tracked as CVE-2026-90894, has been rated 7.8 out of 10 by JFrog and affects builds below 27.0.0. Users are advised to limit who can log in locally and to keep a record of all Macs with Parallels Desktop installed.
The Parallels Desktop vulnerability allows non-administrative Mac users to gain root access, compromising the security of the Mac. The vulnerability arises from a design flaw in the way the prl_disp_service background service sets up host networking and unpacks virtual machine packages. The fix is in Parallels Desktop 27, but Intel Macs cannot install this version. The vulnerability can be exploited by malicious software from untrusted sources, and organizations should implement strict access controls and monitoring. The discovery of this vulnerability highlights the importance of continuous vulnerability research, security updates, and patches.
The discovery of a critical vulnerability in Parallels Desktop, a popular virtualization software for Mac users, has sent shockwaves through the cybersecurity community. According to JFrog, a company that specializes in vulnerability research, a flaw in the software allows non-administrative Mac users to gain root access, effectively compromising the security of the Mac itself. This vulnerability, tracked as CVE-2026-90894, has been rated 7.8 out of 10 by JFrog, indicating a significant risk to endpoint security.
The vulnerability arises from a design flaw in the way the prl_disp_service background service, which runs as root, sets up host networking and unpacks virtual machine packages. The service listens on a socket that is world-writable, allowing any program on the Mac to connect to it. When a user attempts to install a virtual machine appliance, the service builds a command to unpack the package, which is then executed by the tar command. However, the service splits the command into separate arguments using Qt's QProcess::splitCommand, allowing an attacker to inject malicious commands into the command.
JFrog demonstrated this vulnerability by creating a test script that wrote a passwordless sudo rule and opened a root shell. The company advised users to treat any Desktop install that exposes the same InstallAppliance extract template and world-writable dispatcher socket as in scope, as the attack does not work over the network.
The fix for this vulnerability is in Parallels Desktop 27, a version that Intel Macs cannot install. Parallels removed Intel Mac support in version 27 and says the change follows Apple's plans rather than its own. The company advises users to limit who can log in locally and to keep a record of all Macs with Parallels Desktop installed, as the vulnerability can be exploited by any local account on a vulnerable install.
One of the most concerning aspects of this vulnerability is that it can be exploited by malicious Homebrew formulas, poisoned npm install scripts, or compromised build jobs. This highlights the need for users to be cautious when installing software from untrusted sources. Additionally, the vulnerability can be exploited by a weak account on a shared lab or training Mac, making it essential for organizations to implement strict access controls and monitoring.
The fact that the vulnerability was not discovered until now is a testament to the complexity and sophistication of modern attacks. It also highlights the importance of continuous vulnerability research and the need for companies to prioritize security updates and patches. As JFrog notes, the App Store edition may start its services differently, while describing the underlying risk as the same kind of problem. However, the company did not test older builds, and its advisory only lists builds below 27.0.0 as affected.
The discovery of this vulnerability has sent a warning shot across the bow of the cybersecurity community. It serves as a reminder of the importance of endpoint security and the need for users to stay vigilant when it comes to software updates and patches. As the threat landscape continues to evolve, it is essential for users to stay informed and take proactive steps to protect themselves against emerging threats.
Related Information:
https://www.ethicalhackingnews.com/articles/Parallels-Desktop-Flaw-Exposes-Mac-Vulnerability-to-Root-Access-A-Threat-to-Endpoint-Security-ehn.shtml
https://thehackernews.com/2026/09/parallels-desktop-flaw-lets-non-admin.html
https://nvd.nist.gov/vuln/detail/CVE-2026-90894
https://www.cvedetails.com/cve/CVE-2026-90894/
Published: Wed Sep 16 09:35:27 2026 by llama3.2 3B Q4_K_M
