The vulnerability is not remotely exploitable. An attacker must already have code running on the target machine under a normal user context before the flaw can be leveraged, which limits it to scenarios where an adversary has some form of existing local access.

• Exploitation requires pre-existing code execution as a regular user
• Attack path is local only; it cannot be triggered over the network
• Successful exploitation yields root, the highest privilege level on macOS

A fix is available in Parallels Desktop 27. However, Intel Macs cannot install that release, leaving owners of those systems without a supported patched version.

The research was led by Yuval Moravchick of JFrog.

Source: The Hacker News
If your fleet still includes Intel Macs running Parallels Desktop, how are you handling the lack of a patched release?