Affected Systems
Parallels Desktop for Mac versions below 27.0.0. Fix available only in version 27, which requires Apple silicon; Intel-based Macs running version 26.x remain vulnerable. CVE-2026-90894 (CVSS 7.8).
Exploitation Status
No active exploitation reported. Proof-of-concept published by JFrog (ParaShells). Requires local access with non-admin account; exploitation is straightforward once code execution is achieved.
Business Impact
Local privilege escalation from non-admin to root on macOS hosts running Parallels Desktop. Attack vector includes malicious Homebrew formulas, npm install scripts, compromised CI/CD jobs, or any code running as a standard user. Intel Mac users cannot install the patched version 27 and must remain on vulnerable version 26.x. Parallels has not confirmed whether a backport fix will be released for version 26.
Urgency
🟠Within 24 hours
Recommended Actions
- Upgrade Apple silicon Macs running Parallels Desktop to version 27.0.1 (build 58670) or later immediately
- Audit Intel-based Macs running Parallels Desktop 26.x for exposure; restrict local user accounts and disable unused accounts on shared or lab systems
- Monitor Parallels security advisories for backport fixes to version 26.x; contact Parallels support for clarification on Intel Mac remediation timeline
- Restrict installation of untrusted software (Homebrew formulas, npm packages) and review CI/CD pipeline security on affected Macs
- Consider migrating critical workloads from Intel Macs running Parallels to Apple silicon hardware or alternative virtualization platforms if no patch is forthcoming