Is CVE-2026-90894 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90894 being exploited in the wild.

How severe is CVE-2026-90894?

High severity, with a CVSS score of 7.8, published 14 September 2026.

Which products and versions are affected?

Parallels Desktop for Mac 26 and earlier, 27.0.0–27.0.1.

Is there a fix for CVE-2026-90894?

A patch was published on 2026-09-17: Parallels Desktop 27.0.2 (58673) released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-90894 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-90894?

Check whether you run Parallels Desktop for Mac at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90894: Parallels Desktop privilege escalation in prl_disp_service

CVE-2026-90894 · Severity: high · CVSS 7.8 · Published 2026-09-14

Parallels Desktop's display service runs with root privileges and listens on a world-writable socket, allowing any local user to connect. An attacker can exploit command-injection flaws in the appliance installation feature to execute arbitrary commands with root privileges. This could allow a local user to gain complete control of the system and access all data.

Vendors: Parallels.

Quick answers

Is CVE-2026-90894 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90894 being exploited in the wild.
How severe is CVE-2026-90894?: High severity, with a CVSS score of 7.8, published 14 September 2026.
Which products and versions are affected?: Parallels Desktop for Mac 26 and earlier, 27.0.0–27.0.1.
Is there a fix for CVE-2026-90894?: A patch was published on 2026-09-17: Parallels Desktop 27.0.2 (58673) released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-90894 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-90894?: Check whether you run Parallels Desktop for Mac at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability involves multiple weaknesses in prl_disp_service, a root-privileged daemon: (1) the socket /var/run/prl_disp_service.socket is world-writable, (2) local authentication (PrlSrv_LoginLocal) lacks proper validation, and (3) the PrlSrv_InstallAppliance function constructs a tar command with unsanitized user input. When an attacker specifies an appliance folder path containing quotes, Qt's QProcess::splitCommand parser treats the quote as a command-line separator, injecting additional tar flags. On macOS, the --use-compress-program flag allows execution of arbitrary programs as root. No patch has been publicly disclosed, though Parallels Desktop 27.0.2 is mentioned as addressing security vulnerabilities.

Affected products

Parallels Desktop for Mac 26 and earlier, 27.0.0–27.0.1

Timeline

2026-09-14: disclosed
2026-09-17: patched: Parallels Desktop 27.0.2 (58673) released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.