Parallels Desktop flaw hands any local user root on a Mac (CVE-2026-90894)
A vulnerability CVE-2026-90894 in Parallels Desktop for Mac allows any local user to gain root privileges on the host. The issue affects version 26.4.0 on Apple Silicon; a fix was released in Parallels Desktop 27.0.0 in early September 2026.
- CVE-2026-90894 affects Parallels Desktop for Mac 26.4.0 on Apple Silicon
- Exploitation does not require a running virtual machine
- Fix released in Parallels Desktop 27.0.0 in September 2026
- Attacker gains root and can persist via launchd
Read next
Security