New Parallels Desktop Flaw Lets Local Users Seize Root Control of Macs

JFrog disclosed CVE-2026-90894 (“ParaShells”), a local privilege escalation in Parallels Desktop for Mac (confirmed in 26.4.0 on Apple silicon) that allows a low-privileged local user to gain root by exploiting a world-writable Unix socket, a client-authentication weakness, and an argument-injection in appliance unpacking that forces macOS tar to run attacker scripts; Alludo patched the issue in Parallels Desktop 27.0.0 and organizations are advised to inventory Parallels installations, restrict local account permissions, and update to 27.0.0 or later.