Table of Contents
Key Takeaway
- 🔴 Severity: CISA rescored CVE-2026-65400 from 7.1 to 9.8 critical on August 14, 2026, after the Dutch NCSC confirmed active exploitation of macOS Screen Sharing
- 🔓 No Credentials Needed: The flaw is a pre-authentication bypass in the
screensharingddaemon — attackers need no username, no password, and no user interaction to gain root access - ⛏️ Monero Mining: In every reported case, attackers obtained root and deployed a Monero cryptocurrency miner on compromised Macs with port 5900 exposed to the internet
- 🔧 Fix Available: Apple patched the flaw on August 6 in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9 — update immediately or disable Screen Sharing
CISA raised the severity of CVE-2026-65400 from 7.1 to 9.8 critical on August 14, 2026, eight days after Apple shipped an out-of-band patch for a macOS Screen Sharing authentication bypass that Dutch authorities say is under active exploitation. The Netherlands National Cyber Security Centre (NCSC-NL) reported that in every confirmed case, attackers exploited the flaw on Macs with TCP port 5900 exposed to the internet, obtained root access, and deployed a Monero cryptocurrency miner. The vulnerability requires no credentials, no user interaction, and no prior access to the target network — making it one of the most dangerous macOS flaws disclosed in 2026.
The flaw lives in screensharingd, the system daemon that powers macOS Screen Sharing, Apple’s built-in remote desktop feature that uses the VNC protocol over TCP port 5900. Apple credited security researcher Alfredo Pesoli of Bynario for discovering and reporting the issue. The patch, released August 6, addresses the vulnerability through improved state management during authentication — preventing the rogue authentication attempts that allowed attackers to bypass credential checks entirely.
CVE-2026-65400 — A Pre-Authentication Bypass in macOS Screen Sharing
macOS Screen Sharing is disabled by default, but when enabled, it listens on TCP port 5900 and allows remote desktop control over a network using the VNC protocol. The authentication path uses a protocol called Secure Remote Password (SRP) for its native Apple authentication flow. CVE-2026-65400 is a pre-authentication flaw — the bypass occurs before the daemon reaches any of its authentication controls, according to Huntress technical analysis.
This distinction is critical. Rotating the VNC password, disabling legacy VNC password access, or removing approved Screen Sharing user accounts all have zero effect on this vulnerability. The only effective mitigations are patching to macOS Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9 — or disabling macOS Screen Sharing entirely until patching is feasible. There is no configuration hardening that stops this attack.
CISA’s initial scoring on August 6 gave the vulnerability a CVSS of 7.1, using a vector that assumed an attacker needed low-level privileges and could achieve only partial impact. On August 14, CISA replaced that vector with one requiring no privileges and granting full compromise of confidentiality, integrity, and availability, raising the score to 9.8. A day later, CISA’s decision record flipped from “not automatable” to “automatable” — an assessment consistent with unattended Macs being rooted at scale for cryptocurrency mining.
The Attack Timeline — From Patch to Exploitation
The timeline of CVE-2026-65400 reveals how quickly a patched vulnerability becomes a live attack surface:
- July 27, 2026: Apple releases a prior security round fixing CVE-2026-43760, a separate Screen Sharing flaw that required valid credentials to exploit
- August 6, 2026: Apple ships an out-of-band update for macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9 — fixing only CVE-2026-65400, no beta, single CVE
- August 7, 2026: NCSC-NL publishes initial advisory urging immediate updates
- August 12, 2026: NCSC-NL updates advisory confirming active exploitation — multiple systems with port 5900 exposed, root obtained, Monero miner deployed in every case
- August 14, 2026: CISA rescores from 7.1 to 9.8, assesses as automatable
- August 15, 2026: CISA decision record flips to “automatable” despite not yet adding to Known Exploited Vulnerabilities catalog
The August 6 update came just 10 days after Apple’s July 27 security round, making it the second macOS Screen Sharing patch in a single month. The earlier flaw, CVE-2026-43760, required valid credentials to exploit — a fundamentally different and less severe threat. CVE-2026-65400 requires nothing but network access to port 5900, which is why CISA’s rescore from 7.1 to 9.8 was so dramatic.
What the Dutch NCSC Found — Root Access in Every Case
The NCSC-NL advisory, published at advisories.ncsc.nl as NCSC-2026-0280, contained a stark finding: “The NCSC has received a notification indicating that active abuse of this vulnerability has been observed on multiple systems on which port 5900 was accessible from the Internet. In all these cases, root had been accessed on the affected system, and a Monero crypto miner had been placed.”
The consistency of the attack pattern is notable. Every compromised system followed the same path: port 5900 exposed, macOS Screen Sharing enabled, authentication bypassed, root obtained, Monero miner installed. The attackers did not vary their approach — suggesting either a single threat actor or a widely shared exploitation method. The NCSC has not shared details about how many systems were impacted, when the attacks started, or whether the exploitation extends beyond cryptocurrency mining.
Technical details of the bug were presented at the Black Hat security conference, according to Ars Technica, alongside a video of the exploit in action. The root-level access attackers gained matches the level of control researchers demonstrated when they bypassed Memory Integrity Enforcement on Apple’s M5 silicon earlier in 2026 — though the two exploits are unrelated.
Why Monero — The Cryptocurrency Miner of Choice for Attackers
Monero (XMR) is the cryptocurrency most commonly deployed in cryptojacking attacks because it is designed to be untraceable. Unlike Bitcoin, where transactions can be tracked on a public ledger, Monero uses ring signatures and stealth addresses to obscure sender, receiver, and amount. This makes it the preferred currency for malicious miners who want to monetize compromised systems without leaving a financial trail.
Cryptojacking attacks like the one targeting macOS Screen Sharing are designed to run silently in the background, consuming CPU resources to mine cryptocurrency while the victim is unaware. On a compromised Mac, the Monero miner would drain CPU cycles, slow down the system, increase power consumption, and generate heat — but it would not display obvious signs of compromise. The victim might notice their Mac running unusually hot or slow, but the miner is designed to hide its activity.
The choice of Monero also tells us something about the attackers. This is not an espionage operation collecting intelligence or a ransomware group encrypting data for extortion. This is a financially motivated operation using stolen compute cycles to generate cryptocurrency. The threat model is lower sophistication than nation-state actors, but the scale can be significant — a single compromised Mac can generate modest mining revenue, but hundreds or thousands of compromised Macs running silently can produce substantial income.
The Second Screen Sharing Flaw in a Month — A Pattern
CVE-2026-65400 is the second significant macOS Screen Sharing vulnerability patched by Apple within a matter of weeks in 2026, following CVE-2026-43760 in late July. The two flaws are related in context — both affect the same component — but differ in the one dimension that matters most: authentication requirement.
| Attribute | CVE-2026-43760 (July) | CVE-2026-65400 (August) |
|---|---|---|
| Authentication Required | Yes — valid credentials needed | No — pre-authentication bypass |
| CVSS Score | 7.1 (initial) | 7.1 → 9.8 (rescored by CISA) |
| Attack Vector | Network, with credentials | Network, no credentials |
| User Interaction | None | None |
| Exploitation Status | Patched, no known exploitation | Active exploitation confirmed |
| Patch Date | July 27, 2026 | August 6, 2026 (out-of-band) |
The pattern of two Screen Sharing flaws in one month suggests that the authentication mechanism in screensharingd has deeper architectural issues that may not be fully resolved by a single patch. Security teams running macOS in enterprise environments should treat Screen Sharing as a high-risk component and monitor for future advisories.
What Mac Users and IT Teams Must Do Now
The fix is straightforward but requires immediate action. Apple’s patch is available in three releases: macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9. Users should update through System Settings > General > Software Update. The update fixes only CVE-2026-65400 — it is a single-CVE security update, not a full OS revision, which means deployment should be fast.
For users and organizations that cannot immediately update, Apple recommends disabling macOS Screen Sharing entirely: navigate to System Settings > General > Sharing > toggle Screen Sharing off. If remote desktop access is required, use a VPN or SSH tunnel to reach the machine instead of exposing port 5900 directly to the internet. Both were the recommended approach even before this vulnerability existed — port 5900 should never be exposed to the public internet.
IT teams managing fleets of Macs should take three immediate steps:
- Audit exposure: Scan your network for Macs with port 5900 open to the internet. Any Mac with macOS Screen Sharing enabled and port 5900 reachable from outside your network is a candidate for compromise.
- Deploy the patch: Push macOS Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9 to all managed devices. For unmanaged devices, communicate the urgency directly to users.
- Investigate prior exposure: If any Mac was exposed between August 6 and the patch deployment date, check for signs of compromise — unusual CPU usage, unknown processes, unexpected network connections to mining pools, or new launch agents in ~/Library/LaunchAgents.
Not Yet in CISA’s KEV — What That Means
As of August 17, 2026, CVE-2026-65400 has not been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, despite confirmed active exploitation reported by NCSC-NL. The CISA decision record still lists exploitation as “none,” which contradicts the Dutch agency’s findings. This discrepancy means U.S. federal agencies are not yet required to patch under binding operational directives, though CISA’s rescore to 9.8 and “automatable” assessment suggest KEV inclusion is likely imminent.
For private sector organizations, the KEV catalog status is irrelevant — the NCSC-NL confirmation of active exploitation is sufficient justification for immediate patching. Waiting for KEV inclusion before acting is not a defensible security posture when a government cyber agency has already confirmed attacks in the wild.
The Broader Context — A Week of CVSS 10.0 Exploitation
CVE-2026-65400 arrives in the same week as the active exploitation of CVE-2026-58231, a CVSS 10.0 vulnerability in SAP Commerce Cloud that was exploited within 72 hours of patch release. Together, these two vulnerabilities illustrate a pattern that security teams cannot ignore: the window between vulnerability disclosure and active exploitation is collapsing.
The macOS Screen Sharing flaw and the SAP Commerce Cloud flaw share a common thread — both target enterprise-facing systems that organizations often leave exposed to the internet with insufficient monitoring. Both were exploited within days of their respective patches. And both demonstrate that the traditional approach of scheduling patching in monthly or quarterly cycles is no longer viable — a pattern visible in the Microsoft Patch Tuesday August 2026 analysis, where 421 CVEs required patching in a single cycle for any system with an internet-facing component.
For macOS specifically, the lesson is that Apple’s reputation for security does not eliminate the need for vigilance. macOS Screen Sharing is a built-in feature that most users never think about — and that is exactly the kind of component attackers target. The most dangerous vulnerabilities are often not in exotic third-party tools but in the built-in features that everyone assumes are safe — as the Gunra ransomware alert and the Adobe Commerce account takeover both demonstrated this month.
Frequently Asked Questions About macOS Screen Sharing CVE-2026-65400
What is CVE-2026-65400 and how serious is it?
CVE-2026-65400 is a pre-authentication bypass vulnerability in macOS Screen Sharing, the built-in VNC-based remote desktop feature. CISA rescored it from 7.1 to 9.8 critical on August 14, 2026, after the Dutch NCSC confirmed active exploitation. The flaw allows network-based attackers to gain root access without any credentials or user interaction.
Which macOS versions are affected by CVE-2026-65400?
The vulnerability affects macOS versions prior to the August 6, 2026 patch. Apple fixed the flaw in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9. Users on any earlier version of these releases with Screen Sharing enabled are at risk.
How are attackers exploiting the macOS Screen Sharing vulnerability?
Attackers exploit the flaw on Macs with TCP port 5900 exposed to the internet. The bypass occurs before authentication, so no username or password is needed. In every reported case, attackers obtained root access and deployed a Monero cryptocurrency miner. The NCSC-NL confirmed multiple systems were compromised this way.
What should I do if I cannot update my Mac immediately?
If you cannot update right away, disable macOS Screen Sharing by going to System Settings > General > Sharing and toggling Screen Sharing off. If you need remote access, use a VPN or SSH tunnel instead of exposing port 5900 directly to the internet. Never expose port 5900 to the public internet.
Is CVE-2026-65400 the same as the July 2026 macOS Screen Sharing flaw?
No. CVE-2026-43760 was patched on July 27, 2026, and required valid credentials to exploit. CVE-2026-65400 is a separate, more severe flaw patched on August 6 that requires no credentials at all. Both affect the Screen Sharing component, but they are different vulnerabilities with different exploit requirements.
How can I tell if my Mac has been compromised by this vulnerability?
Check for signs of cryptojacking: unusually high CPU usage when the system should be idle, fans running constantly, unexpected network connections to unknown IP addresses (mining pools), and unknown processes in Activity Monitor. Also check ~/Library/LaunchAgents for unfamiliar launch agent files that could be persisting the miner. If any of these signs are present, run a full malware scan and reinstall macOS from recovery mode.
Cybersecurity Disclosure: This article is for informational purposes only and does not constitute professional cybersecurity advice. Organizations should consult with qualified security professionals and follow vendor-specific guidance when implementing vulnerability remediation. WorldNgayon.com is not liable for any actions taken based on the information presented here.
