Apple macOS Screen Sharing Vulnerability
A recently patched security flaw in Apple macOS is now being actively exploited in the wild. Attackers are using it to install cryptocurrency miners on vulnerable Macs.
The vulnerability, tracked as CVE-2026-65400, carries a CVSS score of 9.8. It's a critical authentication issue in the Screen Sharing component. An attacker who can reach your Mac over the network can log in remotely without needing a password.
The Netherlands National Cyber Security Centre issued a warning after receiving reports of active attacks.I will guide you on how things work and what you must do in order to secure your Mac from the attack.
Vulnerability Highlights
- CVE-2026-65400 is a critical flaw for Screen Sharing that allows bypassing authentication
- CVSS Score: 9.8 (Critical)
- Attackers can log in to remote desktop without having any valid credentials
- Attack involves Monero miners
- Fixed in: macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9
- More than 40,000 Screen Sharing hosts are vulnerable online
What's Going On Here?
The Apple macOS Screen Sharing vulnerability is basically a backdoor. If you have Screen Sharing turned on, an attacker on the same network can access your Mac without knowing your password. That's bad enough on its own.
But it gets worse. The Netherlands NCSC confirmed that attackers are actively exploiting this flaw. They're using it to install Monero miners on compromised systems. Monero is one such crypto which prioritizes its users' privacy and is widely favored by cyber criminals due to the difficulty in tracing their transactions.
Apple issued an urgent patch on August 6, 2026. Security researcher Alfredo Pesoli discovered and reported the issue. The fix improves how macOS handles authentication, making sure it actually checks credentials properly.
The patch covers three macOS versions:
- macOS Tahoe 26.6.1
- macOS Sequoia 15.7.9
- macOS Sonoma 14.8.9
- If you're running any other version, you're at risk.
What We Know About the Attacks
The Dutch cybersecurity agency confirmed that attackers are actively exploiting the Apple macOS Screen Sharing vulnerability. Here's what they've observed:
- Multiple systems were compromised
- In every case, port 5900 was accessible from the internet
- Attackers gained root access to the affected systems
- They deployed Monero cryptocurrency miners on each compromised machine
There are still many unknowns. We don't know when these attacks started. We don't know how widespread they are. We don't know if the vulnerability was used as a zero-day before Apple patched it. And we don't know if the attackers are doing anything beyond mining cryptocurrency.
The Scary Reality: Exposed Systems
Security researcher @osxreverser scanned the internet for Screen Sharing hosts. What they found is alarming.
Roughly 40,000 Macs have Screen Sharing exposed to the internet. Almost half of them are in the United States. Most are residential IPs, but there are also plenty of juicy targets in American universities, some companies, and even a server from the BBEdit company.
The researcher had this to say: "Party hard, never expose those services unless behind SSH." It's solid advice. If you need remote access to your Mac, use SSH tunneling or a VPN. Don't open port 5900 to the internet.
The Weird Story Behind the Patch
Here's where things get interesting. The Apple macOS Screen Sharing vulnerability actually involves two separate bugs. They both live in the same source code file.
Bug 1: The Pre-Auth Hack
This one was discovered by @osxreverser. It's a single wrong return value in the code. A length check bails out early on an oversized frame and hands back a value that happens to be the success code from the read just before it. The caller reads that as "this auth step passed" and advances the state machine.
In plain English: send the right packet, and macOS thinks you've already passed the authentication check. No password required. No username needed. Just one packet.
Bug 2: The State Machine Desync
This one is CVE-2026-65400. It's a state machine desync. It requires a username to be named. But that's not much of a barrier. A username isn't a secret. macOS prints them right on the login window.
Both Are Logic Bugs:
Here's what makes these Apple macOS Screen Sharing vulnerabilities particularly dangerous:
- No heap groom
- No ASLR defeat
- No race to win
- No crash
- Send one or two packets in the right order
- The target Mac lets you in
- Works the first time, every time
The second bug was also present in macOS 26.5.2. It was sitting right next to the first one the whole time. Both are logic bugs in the same code. Both are trivial to exploit.
What the Researcher Found
Security researcher Alfredo Pesoli described the post-authentication path in detail. It turns a simple file copy operation into something much more dangerous.
What It Can Do:
- Read protected files as root
- Create attacker-controlled files as root
- Install a malicious sudoers policy
- Turn file-copy operations into remote root command execution
Pesoli explained: "After the VNC authentication step, we cross a boundary the password was never supposed to cross. A remote viewer can make macOS Screen Sharing read protected files as root."
AI Makes It Worse
Calif, an AI security company, revealed something even more concerning. They came up with a working exploit for both Apple macOS Screen Sharing vulnerabilities in just four hours using an AI agent.
This is a good example of how AI is disrupting the field of cybersecurity. The gap between identifying vulnerabilities and weaponization is shrinking rapidly. What used to take skilled researchers days or weeks can now be done in hours by AI.
What to Do Right Now
The Apple macOS Screen Sharing vulnerability requires immediate action:
If You Can Update:
- Update to macOS Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9
- This is the only complete fix
If You Can't Update Right Now:
- Turn off Screen Sharing immediately
- Go to General > Sharing
- Toggle Screen Sharing from "Content & Media" to off
Best Practices for Remote Access:
- Never expose Screen Sharing (port 5900) to the internet
- Use SSH tunneling for remote desktop access
- Use a VPN for remote access
- Keep your system updated
Conclusion
The Apple macOS Screen Sharing vulnerability represents a highly critical flaw that is actively exploited by attackers. Attackers are using it to install Monero miners on vulnerable Macs.
Key facts to know:
- CVE-2026-65400 is a critical authentication bypass vulnerability
- CVSS score: 9.8
- Active exploitation reported by NCSC-NL
- Monero miners are being deployed by attackers
- The vulnerability is patched in macOS 26.6.1
- More than 40,000 Screen Sharing hosts are at risk
- AI can exploit the vulnerability within hours
Mac users should update to the latest macOS version immediately. Disable Screen Sharing if you cannot patch. Never expose Screen Sharing to the internet.
The Apple macOS Screen Sharing vulnerability is one of such examples, which demonstrates that even built-in features might have serious vulnerabilities. Stay updated and stay secure.
FAQ Section
What is the Apple macOS Screen Sharing vulnerability?
CVE-2026-65400 is a severe flaw present in macOS Screen Sharing which allows users to get access to remote desktops without any form of authentication.
Has the vulnerability been exploited by anybody?
Yes. The NCSC-NL has confirmed active exploitation. Attackers are deploying Monero cryptocurrency miners on vulnerable systems.
What versions are affected?
The vulnerability was patched in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9.
What should Mac users do?
Update to the latest macOS version immediately. If you cannot patch, turn off Screen Sharing. Never expose Screen Sharing to the internet.
How many systems are exposed?
Security researchers have found approximately 40,000 open Screen Sharing hosts on the internet. Almost half are in the United States.
