Parallels Desktop Flaw Lets Non-Admin Mac Users Gain Root, but Intel Macs Can't Install Fix
Parallels Desktop flaw allows non-admin Mac users to gain root access.
A vulnerability in Parallels Desktop for Mac, identified as CVE-2026-90894, allows local, non-administrator users to escalate privileges to root. The exploit leverages a world-writable socket and improper argument parsing in the prl_disp_service, enabling arbitrary command execution as root. While a fix is available in Parallels Desktop 27, it is not compatible with Intel-based Macs, leaving a segment of users vulnerable.
AI summary of the linked source. Not reviewed by an editor. How this works
Run JFrog?
Get an email when a new story names JFrog, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA privilege escalation vulnerability in Parallels Desktop exploits a world-writable socket and improper argument parsing in a privileged service, allowing any local user to execute arbitrary commands as root. This is a critical design flaw: exposing a privileged communication channel with insufficient input validation effectively hands attackers a direct path to full system compromise. Compounding the risk, the official fix in Parallels Desktop 27 is incompatible with Intel-based Macs, meaning a significant portion of the user base has no vendor-supported remediation path. This situation highlights how end-of-support hardware/software combinations can leave organizations permanently exposed, requiring compensating controls rather than straightforward patching.
What helps against this
How we list vendors
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-90894