Vuln: CVE-2026-90894 | Detection.FYI

Privilege Escalation via Parallels Appliance Extract Argument Injection

Sep 28, 2026 · Domain: Endpoint Platform: macOS OS: macOS Rule Type: ESQL Use Case: Threat Detection Tactic: Privilege Escalation Tactic: Defense Evasion Data Source: Elastic Defend Vuln: CVE-2026-90894 Resources: Investigation Guide Use Case: Vulnerability ·
Share on:

Identifies the Parallels Desktop root dispatcher (prl_disp_service) spawning tar/bsdtar with more arguments than its fixed extract command uses. The dispatcher always runs a 5-token command (tar -xf -C
), so any additional arguments indicate an attacker-controlled folder name injecting extra tar flags. On macOS these flags let tar read or write attacker-chosen paths or execute an external program as root, resulting in local privilege escalation (CVE-2026-90894, Parallels Desktop < 27.0.0).

Read More