CVE-2026-90894 ("ParaShells"): Parallels Desktop for Mac Local Privilege Escalation via Appliance Extract Argument Injection

Key facts

Detection coverage

As of 2026-09-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2536 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: prl_disp_service Spawning tar with --use-compress-program (ParaShells Argument Injection)

Detects the root-owned Parallels dispatcher daemon (prl_disp_service) spawning tar with an injected --use-compress-program= flag. This is the proximate root-code-execution trigger for CVE-2026-90894 ("ParaShells"): the PrlSrv_InstallAppliance RPC builds an unsanitized tar -xf "%1" -C "%2" string from an attacker-supplied appliance folder name, Qt's QProcess::splitCommand mis-tokenizes an embedded quote character, and the reinterpreted tokens smuggle in --use-compress-program=/path/to/payload, which tar then executes as root.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1548, T1059.004, T1059
• Data sources: osquery process_events (macOS fleet), Microsoft Defender for Endpoint on Mac (DeviceProcessEvents), macOS Endpoint Security framework (es_event_exec via EDR)
• Severity: critical
• Confidence: high

Splunk SPL

index=osquery sourcetype="osquery:process_events" parent_name="prl_disp_service" name="tar" cmdline="*--use-compress-program*"
| eval susp_flag=if(match(cmdline, "--use-compress-program="), "argument_injection", "benign")
| table _time, host, uid, euid, parent_name, parent_pid, name, pid, cmdline, susp_flag
| where susp_flag="argument_injection"
| sort - _time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where DeviceOs == "macOS"
| where InitiatingProcessFileName =~ "prl_disp_service"
| where FileName =~ "tar" or FileName =~ "bsdtar"
| where ProcessCommandLine has "--use-compress-program"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, FileName, FolderPath, ProcessCommandLine, InitiatingProcessAccountName
| order by Timestamp desc

Sigma

title: Parallels prl_disp_service tar Argument Injection (CVE-2026-90894 ParaShells)
id: 7a1e2c4d-9b3f-4e21-8c0a-1f5d6a7b8c01
status: experimental
description: Detects tar being spawned by the root Parallels dispatcher daemon (prl_disp_service) with an injected --use-compress-program flag, the root-code-execution trigger for CVE-2026-90894.
references:
  - https://research.jfrog.com/vulnerabilities/parallels-desktop-is-vulnerable-to-a-local-privilege-escalation-via-appliance-extract-argument-injection-cve-2026-90894/
  - https://www.cve.org/CVERecord?id=CVE-2026-90894
author: Threadlinqs Team
date: 2026-09-16
tags:
  - attack.privilege-escalation
  - attack.t1548
  - attack.execution
  - attack.t1059.004
  - attack.t1059
  - cve.2026.90894
  - attack.tool.parashells
logsource:
  category: process_creation
  product: macos
detection:
  selection_parent:
    ParentImage|contains: 'prl_disp_service'
  selection_image:
    Image|endswith:
      - '/tar'
      - '/bsdtar'
  selection_flag:
    CommandLine|contains: '--use-compress-program'
  condition: all of selection_*
falsepositives:
  - None expected; prl_disp_service does not legitimately pass --use-compress-program to tar during normal appliance installation. Any match warrants immediate triage.
level: critical

Known false positives:

• None expected in normal Parallels Desktop operation — prl_disp_service never legitimately invokes tar with --use-compress-program during appliance installation; verify against any known internal automation/imaging scripts before escalating a true positive to root cause

Tuning notes: Add a code-signature/Team ID check on the parent image path (expect /Library/Parallels/prl_disp_service or /Applications/Parallels Desktop.app/Contents/MacOS/prl_disp_service) to reject spoofed process-name FPs; restrict to Parallels Desktop < 27.0.0 fleet inventory to cut noise on already-patched hosts.

• 🔒 prl_disp_service Spawning tar with --use-compress-program (ParaShells Argument Injection) · unlock with TL Creds
• 🔒 Root Execution of Unsigned /tmp Helper Binary Spawned by tar (ParaShells Post-Exploitation) · unlock with TL Creds
• 🔒 Unprivileged/Supply-Chain-Spawned Process Connecting to World-Writable prl_disp_service Socket Followed by Local Account or SSH-Key Abuse · unlock with TL Creds
• 🔒 prl_disp_service Spawning tar with --use-compress-program (ParaShells Argument Injection) · unlock with TL Creds
• 🔒 Root Execution of Unsigned /tmp Helper Binary Spawned by tar (ParaShells Post-Exploitation) · unlock with TL Creds
• 🔒 Unprivileged/Supply-Chain-Spawned Process Connecting to World-Writable prl_disp_service Socket Followed by Local Account or SSH-Key Abuse · unlock with TL Creds
• 🔒 Root Execution of Unsigned /tmp Helper Binary Spawned by tar (ParaShells Post-Exploitation) · unlock with TL Creds
• 🔒 Unprivileged/Supply-Chain-Spawned Process Connecting to World-Writable prl_disp_service Socket Followed by Local Account or SSH-Key Abuse · unlock with TL Creds

Indicators of compromise

As of 2026-09-16, Threadlinqs Intelligence tracks 9 indicators of compromise for TL-2026-2536.

Technical analysis

JFrog Security Research (Yuval Moravchick) discovered, disclosed, and built a functional (unreleased) PoC dubbed ParaShells; Alludo/Parallels fixed it in Parallels Desktop 27.0.0.

CVE-2026-90894 is a local privilege escalation (LPE) vulnerability in Parallels Desktop for Mac affecting versions prior to 27.0.0, confirmed by JFrog Security Research on Parallels Desktop 26.4.0 build 57513 and 26.4.2 running on Apple Silicon Macs. The flaw chains three separate weaknesses in the privileged host component prl_disp_service, a dispatcher daemon that runs as root to perform sensitive operations such as managing virtual machines, configuring networking, and installing appliance packages.

First, prl_disp_service listens on a Unix domain socket at /var/run/prl_disp_service.socket that is world-writable (mode 0777), so any local process can connect to it regardless of group membership. Second, the daemon's PrlSrv_LoginLocal RPC method authenticates incoming connections purely on OS-reported peer credentials (uid/gid of the connecting process) rather than verifying a Parallels client code-signature or Team ID, so any unprivileged local binary can successfully "log in" to the privileged dispatcher. Third, once authenticated, the PrlSrv_InstallAppliance RPC method lets the caller supply an appliance parent folder path (sVmParentPath) that the daemon uses, unsanitized, to build a single command string of the form tar -xf "%1" -C "%2". This string is handed to Qt's QProcess::splitCommand, which tokenizes it by whitespace and quote characters rather than passing an argv array directly to exec(). Because the folder path is attacker-controlled, embedding a double-quote character in it (e.g. a folder literally named /tmp/sprl_p_<uid>" --use-compress-program=/tmp/u<uid> ") closes the quoted -C argument early and reintroduces the remaining text as additional, attacker-chosen tar flags. macOS tar's --use-compress-program= flag is designed to let a user specify a custom (de)compression helper program; because the daemon subsequently invokes tar as root to "extract" the (nonexistent or empty) appliance, tar executes the attacker-named helper program at /tmp/u<uid> with root privileges, giving the unprivileged local user full code execution as uid 0. No running virtual machine is required to trigger the flaw -- only a vulnerable Parallels Desktop install, the dispatcher socket present, and any local unprivileged account.

JFrog assesses the risk as greatest on developer workstations, where malicious or poisoned Homebrew formulas or npm packages could already grant low-privileged local code execution that this bug then escalates to root, and on shared/multi-user Mac lab or institutional machines where several local accounts coexist. From root, an attacker can replace system software/binaries, read or modify any other local user's data, and establish persistence (e.g., via a root-owned launchd LaunchDaemon).

Alludo (Parallels' parent company) fixed the issue in Parallels Desktop 27.0.0 by changing the appliance-extraction code path to build tar's argument list as a fixed argv array instead of a single shell-like string, so a quote character in the folder name can no longer be reinterpreted as an argument delimiter. JFrog publicly disclosed technical details of CVE-2026-90894 (nicknamed "ParaShells") on 14 September 2026 while withholding release of the working exploit code itself.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Execution

T1059 Command and Scripting Interpreter; T1059.004 Command and Scripting Interpreter: Unix Shell; T1559 Inter-Process Communication

Initial Access

T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools

Persistence

T1543 Create or Modify System Process; T1543.004 Create or Modify System Process: Launch Daemon; T1554 Compromise Host Software Binary

Privilege Escalation

T1548 Abuse Elevation Control Mechanism

Resource Development

T1588.005 Obtain Capabilities: Exploits

Remediation

Patches

• Parallels Desktop 27.0.0 -- builds the tar argument list as a fixed argv array instead of a single parsed command string, preventing quote-character reinterpretation

Immediate actions

• Upgrade Parallels Desktop for Mac to version 27.0.0 or later on all Standard, Pro, Enterprise, and Business Edition installs
• Until patched, restrict or monitor local login access on hosts running vulnerable Parallels Desktop versions, especially shared/multi-user Macs
• Audit the permissions on /var/run/prl_disp_service.socket and alert on unexpected local connections to prl_disp_service

Workarounds

• Restrict local user access on systems that cannot yet be upgraded to Parallels Desktop 27.0.0 (per JFrog Security Research guidance)

Longer-term hardening

• Enforce endpoint patch-management SLAs for virtualization/hypervisor software given its inherent privileged-daemon attack surface
• Harden developer workstations against supply-chain code execution (Homebrew/npm package integrity checks) since such footholds can be escalated via bugs like this one
• Deploy host-based monitoring for anomalous child-process execution from root-owned daemons such as prl_disp_service

Affected and fixed versions

• Alludo (Parallels) — Parallels Desktop for Mac
  Vulnerable versions: 26.4.0 (build 57513); 26.4.2; all versions prior to 27.0.0
  Fixed in: 27.0.0

Timeline

• 2026-08-25 Alludo/Parallels releases Parallels Desktop 27.0.0 (build 58628), which fixes the appliance-extraction argument-injection flaw by building tar's argument list as a fixed argv array instead of a parsed command string.
• 2026-09-14 JFrog Security Research's disclosure specifically flags developer workstations -- where a poisoned Homebrew formula or npm package could already grant low-privileged local code execution -- and shared/multi-user Mac lab or institutional machines as the highest-risk targets for CVE-2026-90894 exploitation.
• 2026-09-14 Parallels Knowledge Base article KB-131168 documents the Parallels Desktop 27.x release notes referenced as the fix vehicle for CVE-2026-90894.
• 2026-09-14 CVE-2026-90894 is published in the NVD/CVE catalog and JFrog Security Research publishes its technical disclosure of the vulnerability, nicknamed ParaShells.
• 2026-09-15 Third-party threat-intel aggregation (OffSeq Threat Radar, drawing on NVD data as of 2026-09-15) publishes an EPSS exploitation-probability score of 0.1% (approximately the 96th percentile) for CVE-2026-90894, indicating low predicted near-term mass exploitation despite the HIGH CVSS severity.
• 2026-09-15 NVD updates/finalizes the CVE-2026-90894 record with CVSS v3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H and CWE-78/CWE-88/CWE-269 classifications.
• 2026-09-16 The Threadlinqs Intelligence harness ingests the Help Net Security coverage of CVE-2026-90894 via RSS and opens threat TL-2026-2536 for research.
• 2026-09-16 Help Net Security and CybersecurityNews publish independent coverage of CVE-2026-90894 / ParaShells, summarizing the JFrog research and urging affected users to update to Parallels Desktop 27.0.0.

Sources cited

• NVD - CVE-2026-90894 NVD (NIST) · Advisory · 2026-09-15
• CVE-2026-90894 Official CVE Record CVE Program · Advisory · 2026-09-14
• Parallels Desktop is vulnerable to a Local Privilege Escalation via Appliance Extract Argument Injection (CVE-2026-90894) research.jfrog.com · Research · 2026-09-14
• Parallels Desktop 27 Release Notes / Knowledge Base 131168 kb.parallels.com · Vendor report · 2026-08-25
• CVE-2026-90894: Parallels Desktop for Mac OS Command Injection strix.ai · Research · 2026-09-16
• OffSeq Threat Radar - CVE-2026-90894 (CWE-88 Argument Injection) radar.offseq.com · Research · 2026-09-15
• Related prior vulnerability class: CVE-2024-34331 Parallels Desktop createinstallmedia signature-verification bypass LPE (same privileged-helper-tooling risk pattern) jhftss.github.io · Research · 2024-05-31
• Parallels Desktop CVE-2026-90894 (ParaShells) Vulnerability Help Net Security · News · 2026-09-16
• Parallels Desktop Vulnerability Lets Non-Admin Mac Users Execute Code as Root cybersecuritynews.com · News · 2026-09-16

More in vulnerability

• Palo Alto Networks PAN-OS (Panorama) Code Injection RCE as Root - CVE-2026-0330
• SignDrop: Unpatched Windows CLFS Zero-Day Enables Local Privilege Escalation to SYSTEM (No CVE)
• Titan Quest: Anniversary Edition heap overflow in .lvl/.pfx file parsing exploited via malicious custom maps (no CVE)
• Microsoft AI-Assisted Research Discloses 59 Linux Kernel Bug Reports (33 CVEs) Incl. 21-Year-Old cls_u32 Flaw CVE-2026-74544; Local Root LPE Exploits Confirmed for 8 CVEs
• Node.js November 2026 Security Releases Patch 16 Vulnerabilities (HTTP/2 crashes, HTTPS heap/TLS key leak CVE-2026-123864, TLS client-certificate auth bypass)

Previous and next in vulnerability

• CISA Warns of Active Exploitation of Critical ConnectWise ScreenConnect Flaw (CVE-2026-84869, CVSS 9.9) Previous report
• CVE-2026-27540: Unauthenticated Arbitrary File Upload in WooCommerce Wholesale Lead Capture Plugin Actively Exploited Next report

Further reading

• Edge RCEs: Cisco SD-WAN, Fortinet, NGINX, Exim