Active Exploitation of macOS Screen Sharing Vulnerability
Malicious actors currently exploit a critical vulnerability in macOS. Specifically, attackers target computers with the “Screen Sharing” feature enabled and exposed. They successfully bypass credential verification and instantly gain root privileges. Subsequently, they install a Monero cryptominer. In all confirmed cases, the victims had exposed port 5900 directly to the internet.
Vulnerability Report: CVE-2026-65400
This critical vulnerability received the identifier CVE-2026-65400. It directly affects the built-in remote screen access functionality within macOS. The core error resides entirely within the authentication logic.
Mechanism of Authentication Bypass
The system incorrectly tracks user verification stages during a specific sequence of network messages. Consequently, it permits access without a correct password. Apple explicitly stated the severe consequences. An attacker with network access to a Mac can authenticate within Screen Sharing without valid credentials. To mitigate this, Apple corrected the authentication process state management. Now, macOS strictly requires and accepts only correct credentials.
Patch Availability and Incident Reports
Apple officially released a patch on August 6 within macOS Tahoe 26.6.1. Simultaneously, patches appeared in macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9. Shortly after the update’s release, reports of practical exploitation surfaced. You can review the official vulnerability advisory regarding CVE-2026-65400 exploitation in macOS from the Dutch National Cyber Security Centre.
The Dutch NCSC received multiple reports of infected systems possessing an internet-facing port 5900. In every confirmed instance, attackers acquired root rights and deployed a Monero cryptominer. Investigators have not yet determined the exact timing of the initial attacks or the total number of compromised machines. Furthermore, it remains unknown whether attackers successfully utilized the vulnerability prior to the August 6 patch release.
The Severity of Root Escalation
Acquiring root rights is particularly vital for accurately assessing the potential consequences. The screensharingd service process receives incoming connections for the screen-sharing function. Critically, this service operates with maximum system privileges. Therefore, successful exploitation extends far beyond simple access to a standard user account.
An attacker gains the terrifying ability to interfere with the entire operating system. They can effortlessly install malicious programs possessing the highest level of administrative rights. The discovery of a Monero cryptominer represents only the initial findings from known infections. It certainly does not reflect the comprehensive array of destructive actions available following a successful breach.
A History of Screen Sharing Flaws
CVE-2026-65400 is not an isolated error within macOS remote management components. On July 27, Apple released macOS Tahoe 26.6 to rectify several other severe Screen Sharing Server problems.
- CVE-2026-43779: Allowed an application to intercept network connections intended for a completely different process.
- CVE-2026-43777: Permitted a remote attacker to intentionally trigger a debilitating denial-of-service condition.
- CVE-2026-43760: Provided unauthorized access to highly sensitive, confidential user data.
The Danger of Legacy VNC Mechanisms
CVE-2026-43760 attracted significant attention due to its exceptionally severe consequences. Executing this attack required enabled Screen Sharing or Remote Management. It also necessitated permitting VNC clients to control the screen using a password, and the attacker needed that specific VNC password. Following successful authentication, the legacy VNC mechanism allowed a remote client to force Screen Sharing to read protected files using root privileges.
Frighteningly, the reverse direction proved equally dangerous. An attacker could write their own custom files acting as the root user. Researchers quickly utilized this second capability to insert an explicit allow rule directly into the sudoers configuration. Following this simple write operation, the file transfer process instantly transformed into a reliable method for executing arbitrary remote commands with maximum privileges.
Technical Simplicity and AI-Assisted Discovery
Simultaneously, researchers discovered another, less demanding error within screensharingd. Breaching a Mac with exposed Screen Sharing required neither a user password nor a VNC password. An attacker only needed the machine’s IP address and basic network connectivity to the service. macOS Tahoe 26.6 effectively closed this specific vulnerability on July 27, although Apple never assigned it a dedicated CVE identifier.
Pre-authentication and State Sequence Errors
The pre-authentication vulnerability patched in macOS 26.6 and CVE-2026-65400 reside within the same component but function differently. The earlier flaw stemmed from an incorrect return value within the code. Conversely, CVE-2026-65400 disrupts the required sequence of authentication states entirely. To exploit it, an attacker must supply a valid account name, but a password remains unnecessary. Both critical errors existed within the exact same source file.
The Ease of Exploitation
The technical simplicity of both attacks is particularly alarming. Successful exploitation does not require complex memory corruption, heap layout manipulation, ASLR circumvention, or race conditions. An attacker merely needs to send one or two specific network packets in the correct sequence to a vulnerable Mac. According to specialists, this simple technique reproduces reliably on unprotected systems.
Rapid Reverse Engineering
Even without a detailed technical description, specialists compared the executable files of macOS 26.6 and 26.6.1. They rapidly identified Apple’s changes and constructed a fully functional exploit. They subsequently compared versions 26.5.2 and 26.6 to recreate the exploitation of the first error. Developing two working attack variants took approximately four hours. Analysts extensively utilized AI tools during their investigation. For instance, an automated GPT-5.5 system actually discovered one of the previously patched Screen Sharing errors.
Required Actions and Mitigation
Mac owners must immediately install macOS Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9. If an immediate update proves impossible, administrators must completely disable the remote access function. Never leave port 5900 exposed directly to the internet.
You can locate the configuration setting here: Apple Menu → System Settings → General → Sharing → Screen Sharing. Furthermore, Apple explicitly clarifies that users cannot enable “Screen Sharing” and “Remote Management” simultaneously.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
