CVE-2026-90894 ("ParaShells"): Parallels Desktop for Mac Local Privilege Escalation via Appliance Extract Argument Injection

CVE-2026-90894 ("ParaShells") (TL-2026-2536), also tracked as ParaShells, is a high-severity software vulnerability scored CVSS 7.8, first published 2026-09-16. It has no confirmed attribution, affects Alludo (Parallels) Parallels Desktop for Mac, references 1 CVE (CVE-2026-90894), maps to 10 MITRE ATT&CK techniques (T1005, T1059, T1059.004), and is covered by 9 detection rules and 9 indicators of compromise.

Key facts for TL-2026-2536

Threat ID
TL-2026-2536
Also known as
ParaShells
Severity
HIGH
CVSS
7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-09-16
Last reviewed
2026-09-16
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology, softwaredevelopment, education
Detection rules
9
Indicators of compromise
9

Malware and tooling in CVE-2026-90894 ("ParaShells")

Malware and tooling: tar (macOS bsdtar)

A local privilege escalation vulnerability in Parallels Desktop for Mac (versions below 27.0.0) lets any unprivileged local user gain root code execution. The root-owned prl_disp_service daemon exposes a world-writable (0777) Unix socket that trusts OS peer credentials instead of verifying a Parallels client signature, and its appliance-extraction RPC builds a tar command from an attacker-supplied folder name via Qt's QProcess::splitCommand, so a crafted folder name injects the tar --use-compress-program= flag to run an arbitrary program as root. JFrog Security Research (Yuval Moravchick) discovered, disclosed, and built a functional (unreleased) PoC dubbed ParaShells; Alludo/Parallels fixed it in Parallels Desktop 27.0.0.

How CVE-2026-90894 ("ParaShells") works

CVE-2026-90894 is a local privilege escalation (LPE) vulnerability in Parallels Desktop for Mac affecting versions prior to 27.0.0, confirmed by JFrog Security Research on Parallels Desktop 26.4.0 build 57513 and 26.4.2 running on Apple Silicon Macs. The flaw chains three separate weaknesses in the privileged host component prl_disp_service, a dispatcher daemon that runs as root to perform sensitive operations such as managing virtual machines, configuring networking, and installing appliance packages.

First, prl_disp_service listens on a Unix domain socket at /var/run/prl_disp_service.socket that is world-writable (mode 0777), so any local process can connect to it regardless of group membership. Second, the daemon's PrlSrv_LoginLocal RPC method authenticates incoming connections purely on OS-reported peer credentials (uid/gid of the connecting process) rather than verifying a Parallels client code-signature or Team ID, so any unprivileged local binary can successfully "log in" to the privileged dispatcher. Third, once authenticated, the PrlSrv_InstallAppliance RPC method lets the caller supply an appliance parent folder path (sVmParentPath) that the daemon uses, unsanitized, to build a single command string of the form tar -xf "%1" -C "%2". This string is handed to Qt's QProcess::splitCommand, which tokenizes it by whitespace and quote characters rather than passing an argv array directly to exec(). Because the folder path is attacker-controlled, embedding a double-quote character in it (e.g. a folder literally named /tmp/sprl_p_<uid>" --use-compress-program=/tmp/u<uid> ") closes the quoted -C argument early and reintroduces the remaining text as additional, attacker-chosen tar flags. macOS tar's --use-compress-program= flag is designed to let a user specify a custom (de)compression helper program; because the daemon subsequently invokes tar as root to "extract" the (nonexistent or empty) appliance, tar executes the attacker-named helper program at /tmp/u<uid> with root privileges, giving the unprivileged local user full code execution as uid 0. No running virtual machine is required to trigger the flaw -- only a vulnerable Parallels Desktop install, the dispatcher socket present, and any local unprivileged account.

JFrog assesses the risk as greatest on developer workstations, where malicious or poisoned Homebrew formulas or npm packages could already grant low-privileged local code execution that this bug then escalates to root, and on shared/multi-user Mac lab or institutional machines where several local accounts coexist. From root, an attacker can replace system software/binaries, read or modify any other local user's data, and establish persistence (e.g., via a root-owned launchd LaunchDaemon).

Alludo (Parallels' parent company) fixed the issue in Parallels Desktop 27.0.0 by changing the appliance-extraction code path to build tar's argument list as a fixed argv array instead of a single shell-like string, so a quote character in the folder name can no longer be reinterpreted as an argument delimiter. JFrog publicly disclosed technical details of CVE-2026-90894 (nicknamed "ParaShells") on 14 September 2026 while withholding release of the working exploit code itself.

MITRE ATT&CK techniques used in TL-2026-2536

Collection

T1005 Data from Local System

Execution

T1059 Command and Scripting Interpreter; T1059.004 Command and Scripting Interpreter: Unix Shell; T1559 Inter-Process Communication

Initial Access

T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools

Persistence

T1543 Create or Modify System Process; T1543.004 Create or Modify System Process: Launch Daemon; T1554 Compromise Host Software Binary

Privilege Escalation

T1548 Abuse Elevation Control Mechanism

Resource Development

T1588.005 Obtain Capabilities: Exploits

Affected products and versions in CVE-2026-90894 ("ParaShells")

  • Alludo (Parallels) — Parallels Desktop for Mac
    Vulnerable versions: 26.4.0 (build 57513); 26.4.2; all versions prior to 27.0.0
    Fixed in: 27.0.0

Remediation for CVE-2026-90894 ("ParaShells")

Patches

  • Parallels Desktop 27.0.0 -- builds the tar argument list as a fixed argv array instead of a single parsed command string, preventing quote-character reinterpretation

Immediate actions

  • Upgrade Parallels Desktop for Mac to version 27.0.0 or later on all Standard, Pro, Enterprise, and Business Edition installs
  • Until patched, restrict or monitor local login access on hosts running vulnerable Parallels Desktop versions, especially shared/multi-user Macs
  • Audit the permissions on /var/run/prl_disp_service.socket and alert on unexpected local connections to prl_disp_service

Workarounds

  • Restrict local user access on systems that cannot yet be upgraded to Parallels Desktop 27.0.0 (per JFrog Security Research guidance)

Longer-term hardening

  • Enforce endpoint patch-management SLAs for virtualization/hypervisor software given its inherent privileged-daemon attack surface
  • Harden developer workstations against supply-chain code execution (Homebrew/npm package integrity checks) since such footholds can be escalated via bugs like this one
  • Deploy host-based monitoring for anomalous child-process execution from root-owned daemons such as prl_disp_service

CVEs associated with CVE-2026-90894 ("ParaShells")

CVE-2026-90894

Weaknesses (CWE) in CVE-2026-90894 ("ParaShells")

CWE-78, CWE-88, CWE-269

Timeline of CVE-2026-90894 ("ParaShells")

  • Alludo/Parallels releases Parallels Desktop 27.0.0 (build 58628), which fixes the appliance-extraction argument-injection flaw by building tar's argument list as a fixed argv array instead of a parsed command string.
  • JFrog Security Research's disclosure specifically flags developer workstations -- where a poisoned Homebrew formula or npm package could already grant low-privileged local code execution -- and shared/multi-user Mac lab or institutional machines as the highest-risk targets for CVE-2026-90894 exploitation.
  • Parallels Knowledge Base article KB-131168 documents the Parallels Desktop 27.x release notes referenced as the fix vehicle for CVE-2026-90894.
  • CVE-2026-90894 is published in the NVD/CVE catalog and JFrog Security Research publishes its technical disclosure of the vulnerability, nicknamed ParaShells.
  • Third-party threat-intel aggregation (OffSeq Threat Radar, drawing on NVD data as of 2026-09-15) publishes an EPSS exploitation-probability score of 0.1% (approximately the 96th percentile) for CVE-2026-90894, indicating low predicted near-term mass exploitation despite the HIGH CVSS severity.
  • NVD updates/finalizes the CVE-2026-90894 record with CVSS v3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H and CWE-78/CWE-88/CWE-269 classifications.
  • The Threadlinqs Intelligence harness ingests the Help Net Security coverage of CVE-2026-90894 via RSS and opens threat TL-2026-2536 for research.
  • Help Net Security and CybersecurityNews publish independent coverage of CVE-2026-90894 / ParaShells, summarizing the JFrog research and urging affected users to update to Parallels Desktop 27.0.0.

Sources cited for CVE-2026-90894 ("ParaShells")

More in vulnerability

Detection coverage for TL-2026-2536

As of 2026-09-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2536 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats