CVE-2026-90894

CVE Enrichment

CVSS: 7.8 HIGH
EPSS: 0.17%
EPSS Percentile: 5.66%
CISA KEV: Not listed

Description

Parallels Desktop runs prl_disp_service as root. Local clients reach it on the world-writable socket /var/run/prl_disp_service.socket. PrlSrv_LoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrv_InstallAppliance lets you pick the appliance folder (sVmParentPath). The daemon unpacks with one string, tar -xf "%1" -C "%2", then Qt QProcess::splitCommand chops that string into words. A quote in the folder name closes early. The leftover text becomes extra tar flags. macOS tar --use-compress-program= runs the named program as root.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: reefs@jfrog.com
Published: 14-Sep-2026 17:17
Last Modified: 19-Sep-2026 02:31
EPSS Date: 2026-10-16
CWE: CWE-78, CWE-88, CWE-269

CVSS Vector


            CVSS:3.1                            AV:L /
                            AC:L /
                            PR:L /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

References

Last enrichment sync: 17-Oct-2026 16:34
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

Parallels Desktop flaw hands any local user root on a Mac (CVE-2026-90894) Week in Review: Cisco Zero-Day Exploitation, Revolut Breach and Other Security News
JFrog disclosed CVE-2026-90894, a Parallels Desktop flaw dubbed “ParaShells” that can let any local user on a Mac escalate to root on the host. Parallels Desktop flaw can give local users root access on Macs

CVE (3)

Malware (2)

People (2)

MITRE ATT&CK (7)

Vendors (7)

Products (6)

Tools (1)

Industries (1)

Countries (3)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.