The record
Written from the 1 report below. Nothing here is unsourced.
- A flaw in Parallels Desktop lets an ordinary local user account on a Mac run code as root, the highest level of access on the machine.
- The attack requires code already running on the Mac as a normal user, so it does not work over the network.
- The fix is available in Parallels Desktop 27, a version that cannot be installed on Intel Macs.
- JFrog has named the flaw ParaShells and tracked it as CVE-2026-90894 with a severity score of 7.8 out of 10.
- Intel Mac users staying on Parallels Desktop 26 have no build that JFrog describes as fixed, leaving them exposed until Parallels says more.
What to watch next
- Whether Parallels publishes a statement or adds the flaw to its security fixes list, which has not been updated since May 2025.
- Whether the fix reaches the Parallels Desktop 26 line used by Intel Mac users.
- Whether a fixed build older than 26.4.2 or a documented 26.4.x repair is confirmed, given JFrog did not regression-test older builds.
Who said what2
Only words found exactly in the article are shown, attributed and linked to the line they came from.
Yuval Moravchick
1 quote · 1 outlet
“We did not regression-test every older build for this writeup”
In the article
…everything the attack needs: the product installed, the service running with its socket present, and a low-privileged local account. No virtual machine has to be running. The company did not check every build. " We did not regression-test every older build for this writeup ," it said, telling readers instead: "Treat any Desktop install that still exposes the same InstallAppliance extract template and world-writable dispatcher socket as in scope." JFrog also said the App Store edition may…
Parallels
1 quote · 1 outlet
“Parallels Desktop 26 fully supports Intel-based Mac computers today, and that will not change”
In the article
…26 Tahoe was the last version of macOS built for Intel Macs and macOS 27 is Apple silicon only, so a product built for macOS 27 cannot install on Intel hardware. Intel users are told to stay on Parallels Desktop 26. " Parallels Desktop 26 fully supports Intel-based Mac computers today, and that will not change ," the company wrote on 25 August, three weeks before this flaw became public, adding that Intel users can keep using version 26 and "expect future security and maintenance updates." That line does not have this fix,…
Coverage1
All filed from India
Named United States · Apple · Parallels · Parallels Desktop · JFrog · Yuval Moravchick
The 1 report is listed beside the record.
Ask this story
Answers cite the reports above, or say they can't.