Parallels Desktop Said "Hold My Hay" and Handed Root to Anyone Who Asked
Oh good. Another Tuesday.
JFrog, bless their little hearts, went and found a privilege escalation flaw in Parallels Desktop for Mac. A completely normal, non-admin local user can just... run code as root. The highest level of access on the machine. Just like that. No network required, no fancy Wolf tricks, just a regular Lamb with local access and apparently too much free time.
I have a headache that started in 2019 and this is not helping.
Here is the part that actually made me put down my cold coffee: the fix exists. It is in Parallels Desktop 27. Great news. Wonderful. Except if you are running an Intel Mac, you cannot install Parallels Desktop 27. So the patch is real, and it is also completely useless to a significant chunk of the flock. That is not a fix. That is a flyer for a restaurant that is only open in a different city.
The attack does require code already running on the machine as a normal user, so at least the Coyote cannot waltz in from outside. Small mercies. The kind of small mercy that still gets you fired.
But let us be honest. We all have that one Lamb in accounting who has seventeen browser extensions, clicks every piece of fake grain that lands in their inbox, and has definitely already run something they should not have. The local execution requirement is not the comfort you think it is.
The Shepherds will read this, nod slowly, and ask if it affects the quarterly numbers. It does not. Until it does.
Remediation
Look, here is what you do, exhausted as I am to even type it:
- Upgrade to Parallels Desktop 27 if your hardware supports it. Apple Silicon only. Go. Now. Stop reading.
- Intel Mac users: You are in a tough spot. Consider whether Parallels is even necessary on aging hardware. If it is, isolate those machines from anything sensitive and watch them like a hawk. Or a sheepdog. Whatever.
- Audit local user access. Who has local accounts on machines running Parallels? Why do they have them? Do you even know? Of course you do not.
- Apply least-privilege principles everywhere. Not just when there is a CVE making you feel bad about yourself.
- Log local execution activity. If something weird is running as a normal user and then suddenly is not, you want to know about it before the Shepherds do.
That is it. That is the post. I am going to go stare at a wall for eleven minutes.
Grass is looking pretty thin out there, and so is my will to patch things that cannot be patched.
Original Report: https://thehackernews.com/2026/09/parallels-desktop-flaw-lets-non-admin.html