Parallels Desktop for Mac contains a privilege escalation vulnerability that allows ordinary local user accounts to execute commands with root privileges, according to security researchers at JFrog who disclosed the flaw this week.
The vulnerability requires an attacker to already have code execution on the target Mac as a standard user. This means the attack cannot be launched remotely over a network. An attacker would need to either trick a user into running malicious code locally or exploit a separate vulnerability to gain initial access. Once executed, the flaw allows the attacker to escalate privileges to root level, granting complete control over the Mac system.
Parallels Desktop is virtualization software widely used by Mac users to run Windows and Linux virtual machines alongside macOS. The application operates with elevated privileges necessary to manage virtual machines and system resources. The privilege escalation flaw stems from how Parallels handles permission requests when transitioning from user-level operations to system-level operations.
JFrog identified the vulnerability and coordinated disclosure with Parallels. The vendor patched the issue in Parallels Desktop version 27. However, the patch introduces a significant limitation for older hardware. Intel-based Mac systems cannot install Parallels Desktop 27. The version 27 release requires Apple silicon Macs, as Parallels has shifted its development focus to native ARM architecture support following Apple's transition away from Intel processors.
This creates a protection gap for Intel Mac users still running Parallels Desktop. Users with Intel Macs remain vulnerable to the privilege escalation attack if they run older versions of Parallels. They cannot upgrade to the patched version without upgrading their Mac hardware entirely.
The vulnerability affects users in several scenarios. Organizations running Intel Macs with Parallels Desktop for development or testing purposes face unpatched exposure. Individual users with older Intel-based Macs, particularly those used in shared environments or by multiple users, confront elevated risk. The attack's local requirement means the threat primarily affects systems where multiple user accounts exist or where users might download and execute untrusted applications.
Parallels recommends Intel Mac users running vulnerable versions of Parallels Desktop practice strong endpoint security hygiene. Users should avoid running untrusted applications, maintain restrictive file permissions, and isolate Parallels-running systems from untrusted networks where possible. However, these mitigations do not eliminate the underlying vulnerability.
Intel Mac owners must evaluate their risk posture and hardware upgrade plans. Users running sensitive workloads or operating in high-threat environments may need to accelerate migration to Apple silicon Macs, where Parallels Desktop 27 and subsequent versions provide protection. Organizations managing fleets of Intel Macs should inventory affected systems and prioritize those in higher-risk scenarios for replacement.
The situation reflects the broader industry shift toward Apple silicon and the end-of-life implications for Intel Mac hardware. As software vendors discontinue Intel Mac support, users face binary choices between remaining vulnerable or upgrading hardware. Parallels' decision to require Apple silicon for version 27 demonstrates how architectural transitions can create security gaps for users on older but still-functional hardware.