Security researchers at JFrog have disclosed a privilege-escalation vulnerability in Parallels Desktop for Mac. The flaw allows a local account without administrator rights to run arbitrary code as root, the highest level of access on the system. Because the attack depends on code already executing as a normal user, it is not exploitable over the network, but it still poses a serious risk on machines shared by multiple users.
The most notable complication is the patch situation. While a fix appears to be available for some systems, Intel-based Macs cannot install it, according to the report. That leaves a significant population of Parallels Desktop users without a way to close the hole.
Parallels Desktop is widely used to run Windows and other operating systems alongside macOS, so the flaw could affect developers, IT administrators, and anyone relying on virtual machines. Users on Intel hardware should treat the risk as ongoing and consider limiting local access until a remedy is provided.