Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2026-90894] ParaShells: Parallels Desktop Turns Appliance Install Into a Root Shell

jfrog.com | vulnerability | CVE-2026-90894 | #privilege-escalation | #lpe | #macos | #vulnerability | #argument-injection | #parallels-desktop | #cve-2026-90894

Summary

JFrog details CVE-2026-90894 in Parallels Desktop: a world-writable prl_disp_service socket, weak peercred auth, and tar argument injection let unprivileged local users execute code as root.
Published
Collected

original ↗

Related coverage

  1. CVE-2026-24294: Windows SMB local NTLM reflection privilege-escalation PoC (github.com)
  2. Chaining N-days to Compromise All: Part 3 — Windows Driver LPE: Medium to System (theori.io)
  3. Binary-searching into CVMServer (theori.io)
  4. Python Software Foundation - Python 3.11.0a3 to 3.15.0b2 (bishopfox.com)
  5. ControlPlane Local Privilege Escalation Vulnerability on macOS (blog.quarkslab.com)
  6. CCleaner Local Privilege Escalation Vulnerability on macOS (blog.quarkslab.com)

back