A feature designed to let people remotely control a Mac has become an entry point for attackers.
The Netherlands’ National Cyber Security Centre (NCSC-NL) says threat actors have exploited a recently patched macOS Screen Sharing vulnerability on multiple internet-accessible systems. In each reported case, the attackers obtained root-level access and installed a Monero cryptocurrency miner.
The vulnerability, tracked as CVE-2026-65400, can let a remote attacker bypass authentication and access Screen Sharing without credentials. Apple fixed the flaw on Aug. 6 in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9.
Key takeaways
- CVE-2026-65400 lets attackers bypass authentication on Macs with Screen Sharing enabled
- NCSC-NL says the flaw has been exploited against multiple systems exposing port 5900 to the internet
- Attackers reportedly gained root access and installed Monero cryptocurrency miners
- The vulnerability affects macOS Tahoe, Sequoia and Sonoma versions released before Aug. 6
- Mac users should update immediately and disable Screen Sharing when it is not needed
- A Mac that may already be compromised should be treated as fully breached, even after it is updated
What is macOS Screen Sharing?
Screen Sharing is Apple’s built-in remote desktop feature. When enabled, it lets someone on another computer view and control a Mac over a network.
As Apple explains, Screen Sharing can be used to open, move and close files, launch applications, and restart a remote Mac. The service uses the Remote Framebuffer protocol, commonly associated with Virtual Network Computing, or VNC, and normally listens on TCP port 5900.
Screen Sharing is not enabled by default on a standard Mac. However, it may be activated on remotely managed workstations, development systems and hosted Mac mini or Mac Studio servers. Some of these devices are intentionally made accessible over the internet, significantly increasing their exposure.
CVE-2026-65400 affects the service’s authentication. Apple’s Sonoma security advisory said the company addressed the issue by improving state management. Apple warned that an attacker on the network might be able to authenticate to Screen Sharing without valid credentials.
How the vulnerability bypasses authentication
The vulnerability involves macOS’s implementation of Secure Remote Password authentication inside the screensharing service.
A technical analysis found that an error in the service’s frame-length validation could cause it to return an outdated success status. As a result, the service may treat an unauthenticated connection as legitimate and allow it to continue without the expected cryptographic protection.
Once connected, an attacker can reportedly abuse Screen Sharing’s privileged file-handling components to read or create files with root-level permissions. That access can then be used to establish persistence or run malicious commands.
Exploitation does not require a valid macOS account, a VNC password or any action from the victim. The CISA vulnerability enrichment data displayed by the National Vulnerability Database assigns it a critical CVSS score of 9.8.
