A newly disclosed high-severity vulnerability in the enterprise virtualization suite Parallels Desktop for macOS enables any unprivileged local user – or a rogue background script running with standard access – to instantly escalate privileges directly to root on the host machine. Tracked in the National Vulnerability Database as CVE-2026-90894 and dubbed "ParaShells", the flaw was publicly disclosed on Wednesday by security researchers at JFrog Security following practical proof-of-concept verification. The vulnerability impacts millions of macOS devices deployed across enterprise and software engineering settings globally.
The flaw resides in the design of the architectural bridge connecting standard macOS user sessions to the privileged background daemons Parallels utilizes to manage virtualized machines. To facilitate direct hardware virtualization, virtual network adapters, and transparent host-guest file sharing (such as mapping folders between macOS and guest Windows 11 or Linux systems), Parallels installs persistent helper daemons running with root privileges, principally the `prl_disp_service` process. JFrog researchers discovered that this daemon listens for local commands across IPC (Inter-Process Communication, the system mechanism for passing data and instructions between active processes in memory) channels without strictly verifying the administrative credentials of the client requesting execution.
By constructing a crafted request payload and directing it to the daemon's local IPC socket, an unprivileged user process can command the Parallels helper to execute arbitrary shell scripts within the operating system. Because the daemon executes commands with elevated system privileges, the injected instructions run as `root` – completely bypassing macOS authorization prompts and Touch ID biometric authentication.
Security researchers emphasize that the operational danger is acute across two widespread enterprise usage scenarios: 1. Developer Laptops and Engineering Workstations: Software engineers routinely pull thousands of open-source libraries via package managers like Homebrew, npm, and PyPI. A single malicious dependency containing a poisoned installation hook (`preinstall` script in npm or `setup.py` execution in Python) can invoke ParaShells to escape process boundaries, establish root persistence, extract private SSH and cloud credentials, and compromise downstream deployment pipelines. 2. Multi-Tenant and Shared Workstations: In corporate and academic lab settings where multiple users log into shared physical Mac computers with standard non-admin credentials, any rogue user can escalate privileges and harvest sensitive data from all other user accounts on the machine.
Hardening Actions and Immediate Remediation
- Deploy Official Parallels Patches Immediately: Upgrade Parallels Desktop to the latest patched release via the software's built-in update mechanism (`Parallels Desktop -> Check for Updates`) or download the clean distribution directly from the vendor.
- Audit Developer Build Pipelines: Enforce strict dependency pinning and disable automatic preinstall script execution on developer systems where hypervisors are active.
- Isolate Legacy Deployments via MDM: Enterprise system administrators utilizing Mobile Device Management platforms (e.g., Jamf Pro or Kandji) should restrict execution of unpatched versions of `prl_disp_service` until fleet-wide updates are completed.
Forensic Investigation and Threat Hunting Indicators
Digital forensic examiners investigating potential exploitation on suspected endpoints should focus on the following evidentiary artifacts:
1. macOS Unified Logging System Telemetry: Query unified logs for abnormal execution sequences spawned by `prl_disp_service`: `log show --predicate 'process == "prl_disp_service"' --info --debug` Inspect telemetry for unexpected invocations of `/bin/sh`, `/bin/zsh`, or python interpreters originating from standard user profiles. 2. Audit Temporary File System Staging: Check for short-lived privilege escalation scripts or payload drops in `/tmp/` and `/var/tmp/` bearing `root:wheel` ownership. 3. Validate Parallels Code Signing Integrity: Confirm binary integrity using Apple's cryptographic verification tool: `codesign --verify --deep --strict /Applications/Parallels\ Desktop.app`