---
title: "macOS Screen Sharing CVE-2026-65400: Exploited Auth Bypass"
url: https://erroneo.us/security/briefs/macos-screen-sharing-auth-bypass-cve-2026-65400/
description: "Network attackers can log in to macOS Screen Sharing without credentials; exploited for root and cryptominers. Fixed in 26.6.1/15.7.9/14.8.9. Check port 5900."
type: security-brief
section: "Security Digest"
date_published: 2026-08-06
date_modified: 2026-08-18
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2026-65400"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# macOS Screen Sharing CVE-2026-65400: Exploited Auth Bypass

**Verdict: Check exposure.** Any Mac with Screen Sharing or Remote Management reachable from an untrusted network needs the update today and a compromise check; Macs with the service off should still update, but they were not reachable by this attack.

- **Who must act:** Owners of Macs with Screen Sharing or Remote Management enabled, especially hosted Mac mini or Mac Studio servers, CI build Macs and remotely administered machines with TCP 5900 reachable.
- **Who can relax:** Macs on the fixed releases, and Macs where Screen Sharing and Remote Management have stayed off (the default on fresh installs), which could not be reached through this flaw.
- **Affected:** macOS Tahoe before 26.6.1; macOS Sequoia before 15.7.9; macOS Sonoma before 14.8.9; Older, unsupported macOS releases (no fix announced)
- **Fixed:** macOS Tahoe 26.6.1 (and 26.7); macOS Sequoia 15.7.9; macOS Sonoma 14.8.9; macOS 27
- **CVEs:** CVE-2026-65400
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Find every Mac listening on TCP 5900 (sudo lsof -iTCP:5900 -sTCP:LISTEN) and every Mac with Screen Sharing or Remote Management enabled.
2. Update to macOS Tahoe 26.6.1 or later, Sequoia 15.7.9 or Sonoma 14.8.9 (softwareupdate -l, then sudo softwareupdate -i -a -R).
3. Turn off Screen Sharing and Remote Management where they are not needed.
4. Block TCP 5900 from the internet; reach Macs remotely only through a VPN or SSH tunnel.
5. Ask hosted-Mac and CI providers which macOS build and remote-access settings their images use.

### How to check if you are affected

- Look for unknown LaunchDaemons with KeepAlive set, a hidden .config/sysmond binary, or a process posing as com.apple.airportd.
- Check root's and users' ~/.ssh/authorized_keys for keys you did not add, and check pf rules for unexpected changes.
- Investigate sustained unexplained CPU load or connections to Monero mining pools.
- Treat cleared shell histories or missing logs on a Mac that exposed port 5900 as a sign of compromise.

## What happened

On August 6, 2026, Apple shipped macOS [Tahoe 26.6.1](https://support.apple.com/en-us/148170), [Sequoia 15.7.9](https://support.apple.com/en-us/148171) and [Sonoma 14.8.9](https://support.apple.com/en-us/148172), each fixing one bug: CVE-2026-65400 in Screen Sharing. Apple's description is short. "An attacker on the network may be able to authenticate to Screen Sharing without valid credentials." Apple says it fixed the authentication issue "with improved state management." The bug is credited to Alfredo Pesoli of Bynario. Apple's notes do not say whether the flaw had been exploited.

It had, or it soon was. The Dutch NCSC flagged the flaw on August 7 and reported active exploitation on August 12. On every internet-exposed Mac it looked at, attackers had gained root and installed a Monero miner ([Bitdefender](https://www.bitdefender.com/en-us/blog/hotforsecurity/macos-screen-sharing-flaw-exploited-crypto-miner-hack)). Microsoft later reported exploitation on a "limited number of macOS devices," with root logins over Screen Sharing ([The Hacker News](https://thehackernews.com/2026/08/apple-macos-screen-sharing-flaw.html)). Apple published no score. CISA's enrichment on the [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-65400) rates it CVSS 3.1 9.8, and [Tanium](https://www.tanium.com/blog/guardian-critical-macos-screen-sharing-authentication-bypass-cve-2026-65400) notes the score was raised from 7.1 on August 14. CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-65400) on August 18, with a federal deadline of August 21.

## Who is affected

Affected: macOS Tahoe before 26.6.1, Sequoia before 15.7.9 and Sonoma before 14.8.9. Tahoe 26.7 and [macOS 27](https://support.apple.com/en-us/149035) (September 14) also include the fix. Only Macs running the Screen Sharing service, the VNC listener on TCP 5900, can be reached through this flaw. Tanium says the service is off by default on fresh installs. Bitdefender points out that it is often switched on for remotely managed workstations, development machines, and hosted Mac mini or Mac Studio servers. The bug is separate from CVE-2026-43760, a Screen Sharing flaw fixed in July that requires the VNC password.

## Do you really need to act?

It depends on one question: can untrusted networks reach port 5900 on any of your Macs? If so, this is urgent. Bitdefender reports that exploitation needs no macOS account, no VNC password and no user action, and the reported intrusions ended in root. A researcher quoted by The Hacker News counted "around 40k open screen sharing hosts on the internet," mostly residential, but universities and companies were among them. Build farms and rented Macs are the likely problem for developer teams. They often run with remote access enabled and older images.

Laptops with Screen Sharing off were not reachable through this bug. Update them on your normal cycle, and confirm with MDM or sw_vers that they actually did. What was seen in the wild was cryptomining. Root on a build Mac, though, also means signing keys, cloud credentials and source code.

## What to do now

1. Find exposed Macs. Run `sudo lsof -iTCP:5900 -sTCP:LISTEN` locally, and scan your public ranges for 5900.
2. Check the build with `sw_vers`, then update: `softwareupdate -l` and `sudo softwareupdate -i -a -R`. Unsupported macOS versions get no fix, so upgrade them or retire them.
3. Turn off Screen Sharing and Remote Management where they aren't needed (System Settings, General, Sharing). Check MDM profiles that may turn them back on.
4. Never expose 5900 to the internet. Use a VPN or an SSH tunnel.
5. For hosted or CI Macs, ask the provider which macOS build and remote-access defaults their images ship with.

## How to tell if you were hit

According to Microsoft, as reported by The Hacker News and Tanium, attackers added an SSH public key, cleared histories and logs, and changed Packet Filter settings. They then ran XMRig 6.26.0, ad-hoc signed and hidden as `.config/sysmond`, disguised as `com.apple.airportd` and kept alive by a LaunchDaemon. Check `/Library/LaunchDaemons` for unfamiliar plists, review `authorized_keys` for root and every user, compare `/etc/pf.conf` with a known-good copy, and watch for sustained CPU load or mining-pool connections. Bitdefender advises treating suspected root access as a full breach. Preserve evidence, erase and reinstall macOS, then rotate credentials, API tokens and SSH keys from a clean device. Patching does not remove an intruder who is already in.

## Timeline

- Aug 6, 2026 — Apple releases macOS 26.6.1, 15.7.9 and 14.8.9.
- Aug 7, 2026 — NCSC-NL flags the vulnerability.
- Aug 12, 2026 — NCSC-NL reports active exploitation on internet-exposed Macs.
- Aug 14, 2026 — CISA rescores the CVE to 9.8.
- Aug 18, 2026 — Microsoft details intrusions, and CISA adds the CVE to KEV (due Aug 21).
- Sep 14, 2026 — macOS 27 ships with the fix.

## Sources

1. [Apple — About the security content of macOS Tahoe 26.6.1](https://support.apple.com/en-us/148170)
2. [Apple — About the security content of macOS Sequoia 15.7.9](https://support.apple.com/en-us/148171)
3. [Apple — About the security content of macOS Sonoma 14.8.9](https://support.apple.com/en-us/148172)
4. [Apple — About the security content of macOS 27](https://support.apple.com/en-us/149035)
5. [CVE record — CVE-2026-65400](https://www.cve.org/CVERecord?id=CVE-2026-65400)
6. [CISA — Known Exploited Vulnerabilities: CVE-2026-65400](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-65400)
7. [Bitdefender — macOS Screen Sharing flaw exploited for crypto-mining](https://www.bitdefender.com/en-us/blog/hotforsecurity/macos-screen-sharing-flaw-exploited-crypto-miner-hack)
8. [Tanium — Critical macOS Screen Sharing authentication bypass (CVE-2026-65400)](https://www.tanium.com/blog/guardian-critical-macos-screen-sharing-authentication-bypass-cve-2026-65400)
9. [The Hacker News — Apple macOS Screen Sharing flaw exploited](https://thehackernews.com/2026/08/apple-macos-screen-sharing-flaw.html)

---
Source page: https://erroneo.us/security/briefs/macos-screen-sharing-auth-bypass-cve-2026-65400/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt