A Critical Flaw in Parallels Desktop Exposes Mac Users to Root Access, But Intel Macs Remain Vulnerable Despite Patch
A severe security vulnerability has been discovered in Parallels Desktop, a popular virtualization software for Mac users. The flaw allows non-administrator users to gain root access on affected systems, potentially leading to catastrophic consequences if exploited by malicious actors. According to reports, the issue affects macOS High Sierra and later versions.
The problem lies in the way Parallels Desktop handles privilege escalation. Normally, only administrators can execute system-level commands or modify system files. However, this vulnerability creates a backdoor that permits non-admin users to access and manipulate critical system components, essentially rendering all security controls ineffective. What’s more alarming is that Intel Macs cannot install the latest patch released by Parallels, leaving their users exposed.
The implications of this flaw are far-reaching, particularly for organizations that rely on macOS devices for sensitive operations or store confidential data within virtualized environments created using Parallels Desktop. As it stands, an attacker with low-level privileges could leverage this vulnerability to escalate their access and potentially execute malicious actions without being detected. The severity of the issue is compounded by the fact that Parallels Desktop users who cannot apply the patch may be forced to rely on workarounds or alternative security measures.
Parallels has issued a statement acknowledging the problem and confirming that they are working diligently to resolve it. In the meantime, administrators should take steps to mitigate potential damage. For instance, disabling user accounts and limiting access to essential system resources can help minimize the impact of an attack. Furthermore, organizations may need to consider implementing additional security controls or monitoring tools to detect suspicious activity within their virtualized environments.
In light of this vulnerability, Mac users who rely on Parallels Desktop should exercise extreme caution when interacting with sensitive data or critical system components. The ability of non-admin users to gain root access is a serious concern that highlights the importance of robust cybersecurity practices and frequent software updates. As a best practice, users should maintain strict account controls, monitor their systems closely for signs of malicious activity, and ensure all security patches are applied promptly to prevent exploitation of this critical flaw.
Source: The Hacker News — 2026-09-16