---
id: 7585
title: "[CVE-2026-90894] ParaShells: Parallels Desktop Turns Appliance Install Into a Root Shell"
cve: CVE-2026-90894
source_domain: jfrog.com
source_url: "https://jfrog.com/blog/parallels-desktop-turns-appliance-install-into-root-shell/"
published_at: "2026-09-15T13:16:25Z"
tags: ["privilege-escalation", "lpe", "macos", "vulnerability", "argument-injection", "parallels-desktop", "cve-2026-90894"]
phying_url: "https://phying.com/item/7585"
lang: en
---

# [CVE-2026-90894] ParaShells: Parallels Desktop Turns Appliance Install Into a Root Shell

## Summary

JFrog details CVE-2026-90894 in Parallels Desktop: a world-writable prl_disp_service socket, weak peercred auth, and tar argument injection let unprivileged local users execute code as root.

## Intelligence Metadata

- **Sources:** jfrog.com
- **CVE:** CVE-2026-90894
- **Published:** 2026-09-15T13:16:25Z
- **Original:** https://jfrog.com/blog/parallels-desktop-turns-appliance-install-into-root-shell/
- **Phying News:** https://phying.com/item/7585