Parallels Desktop runs prl_disp_service as root.

CVE-2026-90894, dubbed ParaShells by JFrog researcher Yuval Moravchick, is a local privilege escalation in Parallels Desktop for Mac affecting all versions prior to 27.0.0 (confirmed on 26.4.0 build 57513, Apple Silicon). The root-running prl_disp_service daemon listens on a world-writable Unix socket (/var/run/prl_disp_service.socket), performs weak local client authentication, and then constructs a tar command by interpolating user-supplied folder paths into a single string. Qt's QProcess::splitCommand tokenizes that string on spaces and quotes — so a crafted directory name containing a double-quote can close the path argument early and inject --use-compress-program=/tmp/evil, causing macOS tar to execute the attacker's script as root. No admin rights, no running VM, and no Parallels-signed binary are required.

The vendor's CVSS 7.8 HIGH is technically accurate for the local impact — AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H correctly reflects that a low-privileged local user achieves full root with no user interaction. Where vendor scoring overstates the *enterprise* risk is reach: Parallels Desktop is a macOS-only Type-2 desktop hypervisor with roughly 0.08% of the overall virtualization market. In a 10,000-host fleet the affected population is typically in the single digits — a handful of developer Macs — not your server estate. The bug is real and reliable, but its blast radius is one macOS workstation at a time.

Why this verdict

• Low friction, reliable chain: The exploit requires only a low-privileged local user, no admin rights, no running VM, and no signed binary. The four-step chain is deterministic — no race conditions, no ASLR bypass, no heap grooming. This keeps the score in HIGH.
• Local-only vector with prior-compromise prerequisite: AV:L means the attacker must already have code execution on the Mac. In a well-managed fleet this implies a prior phishing/malware stage or insider threat, which is a compounding friction factor. Adjusted down ~0.4 from vendor score.
• Narrow installed base: Parallels Desktop is a macOS-only Type-2 hypervisor with ~0.08% virtualization market share. In a 10,000-host enterprise, the affected population is typically 1–10 developer workstations. This sharply limits fleet-wide blast radius. Adjusted down ~0.4 from vendor score.
• Role multiplier: Parallels Desktop is a *desktop* virtualization tool, not an infrastructure hypervisor. Its canonical deployment role is (a) developer workstation or (b) power-user Mac. It is NOT deployed on domain controllers, CI/CD servers, production database tiers, or network edge. A root compromise of one developer Mac is serious (credential theft, source code access) but the blast radius is host-level, not domain or fleet scale. The high-value-role floor does not apply — Parallels is not canonically a high-value-role component, and <1% of installs occupy any infrastructure-critical role.
• No remote exploitation, no KEV, no ITW activity: EPSS at 0.00148 and no CISA KEV listing confirm the threat intelligence community does not currently see active exploitation pressure.

Why not higher?

The bug does not cross a network boundary — it requires local access to a macOS host that already has Parallels installed. The affected product is a desktop application, not an infrastructure hypervisor, identity provider, or network appliance. The installed base in a typical enterprise is negligible, so even a reliable root chain cannot produce fleet-scale impact. No active exploitation or KEV listing exists to force an upgrade.

Why not lower?

The chain is exceptionally clean: low-privilege local user to root with no user interaction, no complexity barriers, and near-instant exploitation. JFrog published enough detail for any skilled attacker to reproduce the exploit. If an adversary is already on a developer's Mac (e.g., via supply-chain compromise of a dev tool), this LPE gives them root immediately — enabling credential harvesting, keychain dumping, and lateral movement from a high-value endpoint.

1. Update to Parallels Desktop 27.0.0 immediately — The vendor patch replaces string interpolation with a proper argv list, eliminating the injection entirely. This is the definitive fix. For a HIGH verdict, deploy within 30 days per noisgate mitigation SLA.
2. Restrict socket permissions on prl_disp_service.socket — Use a LaunchDaemon override or post-install script to chmod 0660 /var/run/prl_disp_service.socket and set group ownership to a dedicated _parallels group. This blocks unprivileged users from connecting. Note: Parallels may reset permissions on restart — monitor with a cron job or configuration management.
3. Deploy EDR process-tree rules for tar child processes under prl_disp_service — Create a detection rule that alerts when tar spawned by prl_disp_service (or any root process) uses --use-compress-program with a path outside Parallels' own directories. CrowdStrike custom IOA or SentinelOne STAR rule can implement this.
4. Audit and minimize Parallels Desktop installations fleet-wide — Use your MDM (Jamf, Kandji, Mosyle) to inventory all hosts with Parallels Desktop installed. Remove it from any machine that doesn't have a documented business need. Fewer installs = smaller attack surface.

Run this script on each macOS host where Parallels Desktop may be installed. No special privileges required — it checks the installed version via defaults read. Example: chmod +x check_parashells.sh && ./check_parashells.sh

#!/bin/bash
# check_parashells.sh — CVE-2026-90894 (ParaShells) version checker
# Target: macOS hosts with Parallels Desktop
# Privileges: none (reads plist only)
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

PLIST="/Applications/Parallels Desktop.app/Contents/Info.plist"

if [ ! -f "$PLIST" ]; then
  echo "UNKNOWN — Parallels Desktop not found at standard path"
  exit 2
fi

VERSION=$(defaults read "$PLIST" CFBundleShortVersionString 2>/dev/null)
if [ -z "$VERSION" ]; then
  echo "UNKNOWN — could not read Parallels version from plist"
  exit 2
fi

# Extract major version number
MAJOR=$(echo "$VERSION" | cut -d. -f1)

echo "Detected Parallels Desktop version: $VERSION"

if [ "$MAJOR" -ge 27 ] 2>/dev/null; then
  echo "PATCHED — version $VERSION is >= 27.0.0 (CVE-2026-90894 fixed)"
  exit 0
else
  # Double-check socket exists (confirms daemon is active)
  if [ -S /var/run/prl_disp_service.socket ]; then
    echo "VULNERABLE — version $VERSION < 27.0.0 AND prl_disp_service socket is active"
  else
    echo "VULNERABLE — version $VERSION < 27.0.0 (socket not found but daemon may restart)"
  fi
  exit 1
fi

Sources

1. JFrog Security Research Advisory
2. Help Net Security — ParaShells Coverage
3. CybersecurityNews — Parallels Desktop Root Execution
4. GBHackers — Parallels Desktop Flaw
5. OffSeq Threat Radar — CVE-2026-90894
6. 6sense — Parallels Virtualization Market Share
7. Strix AI — CVE-2026-90894 Detail