A Parallels bug hands any Mac user root, and Intel Macs cannot install the fix
Future Technology
New article published
SECURITY
A Parallels bug hands any Mac user root, and Intel Macs cannot install the fix
Any user with a local account on a Mac running Parallels Desktop v26.4.0 can become root. There is no password prompt, no administrator group requirement, and no virtual machine needs to be running.
Key Takeaways
- CVE-2026-90894, nicknamed ParaShells, gives any local user root on a Mac running Parallels Desktop v26.4.0 on Apple silicon.
- The attack needs no administrator rights, no running virtual machine and no signed Parallels client application.
- Alludo fixed the chain in Parallels Desktop v27.0.0, released at the start of September.
- Version 27 does not install on Intel Macs, so affected Intel hardware has no patch path at all.
You received this because you subscribe to Future Technology.