erroneo.us
Search all guides⌘K

Security Digest · Aug 6, 2026 · Vulnerability · OS / kernel

macOS Screen Sharing CVE-2026-65400: Exploited Auth Bypass

Network attackers can log in to macOS Screen Sharing without credentials; exploited for root and cryptominers. Fixed in 26.6.1/15.7.9/14.8.9. Check port 5900.

Published By erroneo.us Security Desk · Updated 3 min read9 sources

Our verdict

Check exposure

Any Mac with Screen Sharing or Remote Management reachable from an untrusted network needs the update today and a compromise check; Macs with the service off should still update, but they were not reachable by this attack.

Who must act: Owners of Macs with Screen Sharing or Remote Management enabled, especially hosted Mac mini or Mac Studio servers, CI build Macs and remotely administered machines with TCP 5900 reachable.

Who can relax: Macs on the fixed releases, and Macs where Screen Sharing and Remote Management have stayed off (the default on fresh installs), which could not be reached through this flaw.

Affected
macOS Tahoe before 26.6.1
macOS Sequoia before 15.7.9
macOS Sonoma before 14.8.9
Older, unsupported macOS releases (no fix announced)
Fixed in
macOS Tahoe 26.6.1 (and 26.7)
macOS Sequoia 15.7.9
macOS Sonoma 14.8.9
macOS 27
CVSS
9.8 (v3.1, CISA-ADP)
EPSS
1.7% (percentile 77)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Find every Mac listening on TCP 5900 (sudo lsof -iTCP:5900 -sTCP:LISTEN) and every Mac with Screen Sharing or Remote Management enabled.
  2. Update to macOS Tahoe 26.6.1 or later, Sequoia 15.7.9 or Sonoma 14.8.9 (softwareupdate -l, then sudo softwareupdate -i -a -R).
  3. Turn off Screen Sharing and Remote Management where they are not needed.
  4. Block TCP 5900 from the internet; reach Macs remotely only through a VPN or SSH tunnel.
  5. Ask hosted-Mac and CI providers which macOS build and remote-access settings their images use.

How to check if you are affected or compromised

  • Look for unknown LaunchDaemons with KeepAlive set, a hidden .config/sysmond binary, or a process posing as com.apple.airportd.
  • Check root's and users' ~/.ssh/authorized_keys for keys you did not add, and check pf rules for unexpected changes.
  • Investigate sustained unexplained CPU load or connections to Monero mining pools.
  • Treat cleared shell histories or missing logs on a Mac that exposed port 5900 as a sign of compromise.

What happened#

On August 6, 2026, Apple shipped macOS Tahoe 26.6.1, Sequoia 15.7.9 and Sonoma 14.8.9, each fixing one bug: CVE-2026-65400 in Screen Sharing. Apple's description is short. "An attacker on the network may be able to authenticate to Screen Sharing without valid credentials." Apple says it fixed the authentication issue "with improved state management." The bug is credited to Alfredo Pesoli of Bynario. Apple's notes do not say whether the flaw had been exploited.

It had, or it soon was. The Dutch NCSC flagged the flaw on August 7 and reported active exploitation on August 12. On every internet-exposed Mac it looked at, attackers had gained root and installed a Monero miner (Bitdefender). Microsoft later reported exploitation on a "limited number of macOS devices," with root logins over Screen Sharing (The Hacker News). Apple published no score. CISA's enrichment on the CVE record rates it CVSS 3.1 9.8, and Tanium notes the score was raised from 7.1 on August 14. CISA added the CVE to the KEV catalog on August 18, with a federal deadline of August 21.

Who is affected#

Affected: macOS Tahoe before 26.6.1, Sequoia before 15.7.9 and Sonoma before 14.8.9. Tahoe 26.7 and macOS 27 (September 14) also include the fix. Only Macs running the Screen Sharing service, the VNC listener on TCP 5900, can be reached through this flaw. Tanium says the service is off by default on fresh installs. Bitdefender points out that it is often switched on for remotely managed workstations, development machines, and hosted Mac mini or Mac Studio servers. The bug is separate from CVE-2026-43760, a Screen Sharing flaw fixed in July that requires the VNC password.

Do you really need to act?#

It depends on one question: can untrusted networks reach port 5900 on any of your Macs? If so, this is urgent. Bitdefender reports that exploitation needs no macOS account, no VNC password and no user action, and the reported intrusions ended in root. A researcher quoted by The Hacker News counted "around 40k open screen sharing hosts on the internet," mostly residential, but universities and companies were among them. Build farms and rented Macs are the likely problem for developer teams. They often run with remote access enabled and older images.

Laptops with Screen Sharing off were not reachable through this bug. Update them on your normal cycle, and confirm with MDM or sw_vers that they actually did. What was seen in the wild was cryptomining. Root on a build Mac, though, also means signing keys, cloud credentials and source code.

What to do now#

  1. Find exposed Macs. Run sudo lsof -iTCP:5900 -sTCP:LISTEN locally, and scan your public ranges for 5900.
  2. Check the build with sw_vers, then update: softwareupdate -l and sudo softwareupdate -i -a -R. Unsupported macOS versions get no fix, so upgrade them or retire them.
  3. Turn off Screen Sharing and Remote Management where they aren't needed (System Settings, General, Sharing). Check MDM profiles that may turn them back on.
  4. Never expose 5900 to the internet. Use a VPN or an SSH tunnel.
  5. For hosted or CI Macs, ask the provider which macOS build and remote-access defaults their images ship with.

How to tell if you were hit#

According to Microsoft, as reported by The Hacker News and Tanium, attackers added an SSH public key, cleared histories and logs, and changed Packet Filter settings. They then ran XMRig 6.26.0, ad-hoc signed and hidden as .config/sysmond, disguised as com.apple.airportd and kept alive by a LaunchDaemon. Check /Library/LaunchDaemons for unfamiliar plists, review authorized_keys for root and every user, compare /etc/pf.conf with a known-good copy, and watch for sustained CPU load or mining-pool connections. Bitdefender advises treating suspected root access as a full breach. Preserve evidence, erase and reinstall macOS, then rotate credentials, API tokens and SSH keys from a clean device. Patching does not remove an intruder who is already in.

Timeline#

  • — Apple releases macOS 26.6.1, 15.7.9 and 14.8.9.
  • — NCSC-NL flags the vulnerability.
  • — NCSC-NL reports active exploitation on internet-exposed Macs.
  • — CISA rescores the CVE to 9.8.
  • — Microsoft details intrusions, and CISA adds the CVE to KEV (due Aug 21).
  • — macOS 27 ships with the fix.

Vulnerability records

  • CVE-2026-65400 · KEV 2026-08-18 · An authentication issue was addressed with improved state management.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Apple — About the security content of macOS Tahoe 26.6.1 support.apple.com
  2. Apple — About the security content of macOS Sequoia 15.7.9 support.apple.com
  3. Apple — About the security content of macOS Sonoma 14.8.9 support.apple.com
  4. Apple — About the security content of macOS 27 support.apple.com
  5. CVE record — CVE-2026-65400 cve.org
  6. CISA — Known Exploited Vulnerabilities: CVE-2026-65400 cisa.gov
  7. Bitdefender — macOS Screen Sharing flaw exploited for crypto-mining bitdefender.com
  8. Tanium — Critical macOS Screen Sharing authentication bypass (CVE-2026-65400) tanium.com

Coverage and analysis

  1. The Hacker News — Apple macOS Screen Sharing flaw exploited thehackernews.com