Local Privilege Escalation in Parallels Desktop for Mac by Parallels
CVE-2026-90894

7.8HIGH

Key Information:

Vendor

Parallels

Status
Parallels Desktop For Mac
Vendor
CVE Published:
14 September 2026

Badges

👾 Exploit Exists📰 News Worthy

What is CVE-2026-90894?

A local privilege escalation vulnerability exists in Parallels Desktop for Mac due to the handling of the prl_disp_service running as root. The service listens on a world-writable socket, allowing unauthorized local clients to interact with it without proper permissions. The vulnerability facilitates an exploitable scenario where a specially crafted appliance folder name can lead to additional tar flags being executed as root, potentially compromising the system's integrity and security.

Affected Version(s)

Parallels Desktop for Mac macOS 26.4.0

Parallels Desktop for Mac macOS 27.0.0

News Articles

favicon imageThe Hacker News

Parallels Desktop Flaw Lets Non-Admin Mac Users Gain Root, but Intel Macs Can't Install Fix

A Parallels Desktop flaw lets a low-privileged local Mac user run code as root; JFrog says the fix is in version 27, unavailable on Intel Macs.

1 month ago

References

https://www.parallels.com/products/desktop/
product
https://kb.parallels.com/en/131168
release-notes

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 📰

    First article discovered by The Hacker News

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yuval Moravchick | JFrog
.