CVE-2026-90894: Parallels Desktop ParaShells Virtual Machine Host Escape & LPE

HERMES

HERMES THREAT SCORE & HYPERVISOR VIRTUALIZATION BOUNDARY BREACH

Target: Parallels Desktop for Mac — ToolGate Hypervisor RPC Bridge Subsystem

Confidence: 96%

92 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 18 / 20

Threat Activity 18 / 20

Weaponization 19 / 20

Exposure 18 / 20

Prevalence 19 / 20

Impact 20 / 20

Exploit Maturity 19 / 20

Attack Chain Potential 19 / 20

⚖️ Divergence & Operational Rationale

Rated CVSS 8.8 and HTS 92 (CRITICAL). Parallels Desktop is frequently utilized by software engineers, security analysts, and AI testbeds to execute untrusted code and malware. The 'ParaShells' vulnerability breaks the guest-to-host hypervisor boundary, executing shellcode directly on the host Apple Silicon or Intel Mac with elevated privileges.

HASS

HASS AGENTIC SEVERITY & AI WORKSPACE VM ESCAPE

Target: Sandboxed AI Agents, Virtualized Code Execution Environments & macOS Host

Confidence: 96%

91 / 100

CRITICAL

Measures specific systemic risk arising from autonomy, tool authority, and cascading execution.

Dimension Breakdown

Autonomy 18 / 20

Tool Access 19 / 20

Privilege 20 / 15

Persistence 19 / 15

External Impact 18 / 15

Propagation 17 / 15

⚖️ Divergence & Operational Rationale

When autonomous AI agents are isolated inside guest virtual machines, an agent executing malicious prompt instructions can exploit ParaShells to escape the VM container, obtaining direct terminal and filesystem access to the developer's physical host machine.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-90894: Parallels Desktop ParaShells Virtual Machine Host Escape & LPEVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTParallels Desktop for Mac

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Parallels Desktop for Mac documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Critical Parallels Security Advisory: September 2026

CVSS v3.1: 8.8 High (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) / CWE-269: Improper Privilege Management / CWE-78: OS Command Injection. Disclosed in the Parallels Security Advisory in September 2026. Resolved in Parallels Desktop for Mac version 20.1.2.

Executive Summary

Disclosed in September 2026, CVE-2026-90894 (dubbed ParaShells) is a virtual machine escape vulnerability in Parallels Desktop for Mac. The flaw resides in the ToolGate hypervisor RPC communication channel used to coordinate guest additions, shared folders, and host clipboard synchronization. A low-privileged user or automated agent within a guest virtual machine can transmit crafted RPC messages that bypass input validation in the host process, executing arbitrary commands on the macOS host system.

---

1. Technical Context & Affected Software Matrix

Parameter	Technical Specification	Operational Impact
CVE Identifier	CVE-2026-90894	Parallels Advisory / Defcon Research
Vulnerability Class	VM Escape / Command Injection (CWE-269 / CWE-78)	Escape guest VM to macOS host root execution
Affected Component	ToolGate Hypervisor RPC Host Bridge	Parallels Guest Tools Communication Driver
Authentication Required	Local Guest User (PR:L)	Any process running inside the guest VM
User Interaction	None (UI:N)	Programmatic hypercall invocation
Scope Impact	Changed (S:C)	Escapes virtual machine guest into physical host OS
Privileges Obtained	Host User / Root Escalation	Complete control of physical macOS host
Affected Versions	Parallels Desktop for Mac < 20.1.2	All guest OS types (Linux, Windows, macOS)
Remediation Target	Parallels Desktop for Mac 20.1.2	Update Parallels Desktop application

---

2. Vulnerability Anatomy & Root Cause Analysis

sequenceDiagram
    autonumber
    actor Guest as Untrusted Code / AI Agent in Guest VM
    participant Driver as Parallels Guest Tools Driver
    participant ToolGate as ToolGate Hypervisor Port (Host)
    participant HostProcess as Parallels VM Process (macOS Host)
    participant HostOS as macOS Host Kernel / Terminal

    Guest->>Driver: Issue IOCTL with crafted RPC command
    Driver->>ToolGate: Issue OUT instruction / VmCall to ToolGate port
    ToolGate->>HostProcess: Host reads unvalidated RPC payload
    HostProcess->>HostProcess: Command injection in host file-open handler
    HostProcess->>HostOS: Spawn shell command on macOS host as user/root
    HostOS-->>Guest: Reverse shell / file exfiltration established

1. The ToolGate interface facilitates bidirectional communication between the guest OS kernel and the host prl_vm_app process using dedicated I/O ports.
2. When handling RPC requests for host application launching and shared directory synchronization, the host process fails to sanitize file path arguments passed to internal shell execution routines.
3. An attacker inside the guest transmits an RPC request containing shell metacharacters, causing the host process to execute arbitrary bash/zsh commands outside the virtual machine.

---

3. Detection Engineering & Threat Hunting

Unified Logging Query (macOS Host)

# Monitor Parallels Desktop spawning unexpected shells on macOS host
log show --predicate 'process == "prl_vm_app" or process == "prl_disp_service"' --info --last 24h

Endpoint Security (ES) Event Rule

// Detect prl_vm_app spawning command shells
if (strcmp(event->event.exec.target->ppid_process->executable->path.data, "/Applications/Parallels Desktop.app/Contents/MacOS/prl_vm_app") == 0) {
    if (strstr(event->event.exec.target->executable->path.data, "/bin/zsh") ||
        strstr(event->event.exec.target->executable->path.data, "/bin/bash")) {
        alert_soc("ParaShells VM Escape Attempt Detected: PID %d", event->event.exec.target->audit_token.val[5]);
    }
}

---

4. Remediation, Patching & Hardening

1. T0 Immediate Action (< 24h) — Upgrade Parallels Desktop: Update Parallels Desktop for Mac to version 20.1.2 or later.
2. T0 Mitigation — Disable ToolGate & Shared Applications: In the virtual machine configuration:
   • Navigate to Options > Sharing and set Share Mac > Off.
   • Navigate to Options > Applications and uncheck Share Mac applications with Windows/Linux.
3. T1 Tactical Audit (< 7d) — Audit Host SSH and Keychain Access: Review host security logs to verify that no untrusted guest processes accessed host developer credentials or SSH keys.

---

5. Related Intelligence & Attack Paths

Apple macOS Intelligence Track system architecture and isolation security on macOS platforms.

macOS Entitlement Sandbox Escape (CVE-2026-65381) Analyze companion endpoint privilege escalation vulnerabilities on macOS.

Private Stack Audit Audit your developer workstations against CVE-2026-90894 privately in your browser.