A serious vulnerability in Apple’s macOS Screen Sharing service is being actively exploited to compromise internet-connected Macs, obtain root-level access and install Monero cryptocurrency miners, according to an urgent warning from the Netherlands’ National Cyber Security Centre.
The vulnerability, tracked asCVE-2026-65400, allows an attacker who can reach a vulnerable Mac’s Screen Sharing service to bypass authentication without possessing a valid password. Successful exploitation can give the intruder extensive control over the affected system, including the ability to access files, execute commands, change configurations and install persistent malware.
The Dutch NCSC said it had received reports of exploitation affecting multiple systems where TCP port 5900—the standard port used by Screen Sharing and Virtual Network Computing—was directly accessible from the public internet.
“In all these cases, root had been accessed on the affected system and a Monero crypto miner had been placed,” the agency said in itssecurity advisory.
The discovery confirms thatCVE-2026-65400has moved beyond laboratory demonstrations and publicly available proof-of-concept code into real-world attacks. Although the observed attackers have so far focused on cryptocurrency mining, the vulnerability provides a route to much more damaging activity, including credential theft, data exfiltration, ransomware deployment and access to corporate networks.
Apple released emergency fixes on August 6 for the three supported macOS generations. The vulnerability is patched in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9.
Administrators responsible for remotely managed Macs, hosted Mac minis, development systems and continuous-integration infrastructure are being urged to treat the issue as an immediate patching priority.
Authentication can be bypassed before login
Screen Sharing is a built-in macOS remote-administration feature that allows another computer to view and control a Mac’s desktop. Once connected, an authorised user can operate the keyboard and mouse, launch applications and interact with the machine as though physically sitting in front of it.
The service uses the Remote Framebuffer protocol associated with VNC and typically listens on TCP port 5900. It supports Apple account-based authentication as well as a legacy VNC password mechanism.
CVE-2026-65400affects the authentication process itself. Apple described the vulnerability as an authentication issue caused by improper state management, saying that an attacker on the network “may be able to authenticate to Screen Sharing without valid credentials.”
The company addressed the problem by improving the way the service manages authentication states. Apple credited Alfredo Pesoli through Bynario Atlas with reporting the vulnerability.Apple’s Tahoe security advisorycontains only one vulnerability entry, underscoring the narrow and urgent nature of the out-of-band release.
Independent researchers have described the weakness as a state-machine or protocol-desynchronisation flaw. By sending specially constructed data during the authentication exchange, an attacker can cause the Screen Sharing daemon to progress as though an authentication step had succeeded even though the expected credentials were never supplied.
This is particularly dangerous because the attack occurs before authentication. It does not depend on stealing a user’s password, convincing someone to open a malicious attachment or first gaining a foothold through another vulnerability.
Public technical analysis indicates that an attacker may need to know or guess a local account name in some exploitation paths. That offers little meaningful protection. Usernames are often predictable, exposed elsewhere in an organisation or visible on the Mac’s login screen.
Why the flaw can lead to root access
At first glance, Apple’s description suggests thatCVE-2026-65400merely permits an unauthorised Screen Sharing login. The practical consequences are substantially more serious.
The macOS service that handles incoming Screen Sharing connections, screensharingd, interacts with privileged helper components responsible for activities such as transferring files. Researchers found that these components can perform operations with root privileges, giving an attacker a path from an authentication bypass to complete system compromise.
Root is the most privileged account on macOS. Access at that level can allow an intruder to read or modify other users’ files, install system-wide persistence, tamper with security settings and execute malware outside the limits applied to ordinary applications.
Huntress said its analysis showed that the vulnerability affects the Screen Sharing service’s implementation of the Secure Remote Password protocol and can ultimately result in pre-authentication remote code execution. It warned that all earlier builds in the three supported macOS branches remain vulnerable, including Tahoe 26.6, Sequoia 15.7.8 and Sonoma 14.8.8.Huntress’s technical assessmentalso highlights the distinction betweenCVE-2026-65400and a separate Screen Sharing vulnerability disclosed shortly before it.
The risk assessment attached toCVE-2026-65400has changed as researchers have developed a fuller understanding of its impact. Earlier records gave it a CVSS score of 7.1 and assumed that limited privileges were required. On August 14, CISA’s vulnerability-enrichment data changed the CVSS 3.1 vector to reflect a remotely exploitable attack requiring no privileges or user interaction and capable of causing a complete loss of confidentiality, integrity and availability.
That revised vector produces a critical score of 9.8, according to the National Vulnerability Database entry. The change better reflects the unauthenticated root-compromise scenario demonstrated publicly and subsequently observed in attacks.
Researchers rapidly reconstructed the exploit
The likelihood of widespread exploitation increased sharply after researchers reverse-engineered Apple’s update and published working demonstrations.
Researchers at Calif said they compared the binaries from macOS Tahoe 26.6 and 26.6.1 and reconstructed a functional exploit in approximately four hours. Their analysis concluded that the weakness was a reliable logic flaw rather than a difficult memory-corruption vulnerability.
The exploit does not appear to require heap manipulation, an Address Space Layout Randomisation bypass or success in a narrow timing window. Instead, researchers said that carefully ordered network messages could cause an unpatched Screen Sharing service to accept the attacker.
That reliability makes the bug more attractive for automation. Attackers can scan large sections of the internet for systems responding on port 5900, determine whether they appear to be Macs and attempt exploitation without having to customise the attack for each target.
A researcher cited inCalif’s technical reportclaimed that a previous scan had identified approximately 40,000 internet-accessible Screen Sharing hosts. That figure has not been independently verified as a count of vulnerable systems, and some exposed hosts may already have been patched or protected by other controls. Nevertheless, it illustrates the potential size of the remotely reachable attack surface.
The rapid reconstruction also demonstrates why applying a patch quickly is increasingly important. Once a vendor publishes an update, defenders gain a remedy, but attackers simultaneously receive clues about the location and nature of the corrected code. Comparing patched and unpatched binaries can reveal the underlying vulnerability even when the vendor provides few technical details.
Exploitation used exposed port 5900
The incidents reported to the Dutch NCSC involved Macs with port 5900 exposed to the internet. An attacker who cannot communicate with the Screen Sharing service cannot exploit the vulnerability through that network path.
Most domestic routers block unsolicited inbound connections by default through network address translation and firewall controls. However, port-forwarding rules, cloud firewall configurations, hosting-provider settings or deliberately exposed remote-management services can make port 5900 reachable from anywhere.
The highest-risk environments include remotely hosted Mac minis, build servers, test laboratories, university systems and production machines used for iOS or macOS software development. These systems are frequently administered remotely and may remain powered on continuously.
Corporate laptops and desktops can also be exposed indirectly. Even if port 5900 is not reachable from the public internet, an attacker who has already compromised another device on the same internal network may be able to target unpatched Macs laterally.
Apple’s wording that an attacker must be “on the network” should therefore not be interpreted as meaning the attacker must be physically connected to the victim’s Wi-Fi. It means the attacker must have a network route to the Screen Sharing service. If port 5900 is publicly exposed, that route can originate from almost anywhere.
Monero mining may be only the first stage
The confirmed attacks installed software that mines Monero, a cryptocurrency designed to provide stronger transaction privacy than many competing digital currencies.
Cryptocurrency miners secretly consume a victim’s processor capacity and electricity to generate revenue for the attacker. On compromised Macs, users may notice sustained high CPU usage, reduced performance, excessive heat, loud cooling fans or unusually high power consumption.
Mining activity is often treated as less destructive than ransomware or data theft, but its presence demonstrates that an attacker has already achieved code execution and installed unauthorised software. The miner may not be the only payload on the machine.
An intruder with root privileges could also extract browser data, authentication tokens, developer credentials, SSH keys,ac could expose access to Git repositories, code-signing systems, cloud platforms or software-delivery pipelines
Attackers could install remote-access tools, create new accounts, deploy launch daemons that survive reboots or modify security controls to conceal subsequent activity. The same entry point could also be adopted by ransomware groups or state-backed operators once reliable exploit code becomes widely available.
There is currently no public evidence that the observed exploitation campaign has deployed ransomware or sophisticated espionage malware. However, organisations should not assume that a system is safe simply because the only immediately visible artefact is a cryptocurrency miner.
A patch does not remove an existing compromise
Installing Apple’s update prevents CVE-2026-65400 from being exploited again, but it does not remove malware, accounts or persistence mechanisms placed on a Mac before the update was applied.
Any organisation that operated an unpatched Mac with port 5900 accessible from the internet should investigate the system for evidence of compromise. That review should cover unexpected processes, persistent launch agents or launch daemons, newly created accounts, unusual outbound connections, unexplained configuration changes and evidence of cryptocurrency-mining activity.
Endpoint-security telemetry and network logs should also be examined for unusual Screen Sharing connections, especially sessions originating from unfamiliar external addresses. Administrators should review whether privileged files were created or modified and determine whether credentials stored or used on the affected system need to be revoked.
If root compromise is confirmed—or cannot be confidently ruled out—the safest response may be to isolate and rebuild the Mac from a known-gooddentials and cryptographic keys accessible from the machine should be rotated
Organisations should also examine what the compromised Mac could reach. A desktop system may hold active sessions for email, identity platforms, code repositories, cloud consoles, internal applications and virtual private networks. Incident response must therefore extend beyond the affected endpoint when those credentials may have been exposed.
Macs should be updated immediately
The definitive remediation is to install one of Apple’s August 6 releases:
Apple has not published equivalent fixes for unsupported macOS releases. Macs running older versions should be upgraded to a supported branch or isolated with Screen Sharing disabled.
Users can check their installed version throughSystem Settings > General > Software Update. Screen Sharing can be disabled throughSystem Settings > General > Sharing, where the Screen Sharing toggle should be switched off unless the service is genuinely required.
Organisations should block unsolicited inbound traffic to TCP port 5900 at perimeter firewalls and remove unnecessary router port-forwarding rules. Screen Sharing should not be directly exposed to the public internet, even after patching. Where remote graphical administration is necessary, access should be restricted through a properly secured VPN, a tightly controlled management network or equivalent zero-trust access controls.
Administrators should also inventory managed Macs to identify where Screen Sharing or Remote Management is enabled. It is not enough to ask users whether they use the feature: remotely provisioned Macs and older build systems may retain configurations established months or years earlier.
The safest course is to patch every supported Mac, disable unused Screen Sharing services and investigate any system that was both vulnerable and reachable through port 5900. With reliable exploit information now public and active attacks confirmed,CVE-2026-65400should no longer be treated as a theoretical risk.
