- The Mess: Apple’s built-in Screen Sharing has a nasty authentication flaw tracked as CVE-2026-65400. An attacker on the network can bypass valid credentials and authenticate to Screen Sharing anyway. CISA rates the bug 9.8 Critical and lists it as actively exploited.
This is not a theoretical “maybe someday” vulnerability.
Attackers have already used the flaw against internet-exposed Macs. Dutch cybersecurity officials reported compromises where attackers gained root access and installed a Monero cryptocurrency miner. Researchers have also demonstrated the exploit publicly.
The vulnerable component is macOS Screen Sharing, Apple’s built-in remote desktop service. It normally requires authentication before someone can control the Mac.
CVE-2026-65400 breaks that assumption.
The original vulnerability rating was much lower. CISA later changed the assessment to CVSS 9.8, with no privileges required, no user interaction required and full impact on confidentiality, integrity and availability. CISA also marked exploitation as active and automatable.
The attack surface gets particularly ugly when administrators expose Screen Sharing directly to the internet through TCP port 5900.
That turns a remote support feature into a front door.
- The Damage: A successful attack can give an attacker control of the Mac, including root-level access, allowing them to steal data, credentials and tokens, install malware, or use the machine for cryptocurrency mining and further attacks.
And mining Monero is hardly the worst thing an attacker could do with root.
A compromised Mac can contain browser sessions, SSH keys, cloud credentials, API tokens, documents and access to corporate systems. In a business environment, one compromised Mac can become the starting point for something much larger.
The good news is that Apple already shipped the fix.
The bad news is that patching does not clean an already compromised machine.
If Screen Sharing was enabled and exposed before the update, administrators should check authentication logs and investigate unexpected processes, accounts, persistence mechanisms and outbound connections.
- The Fix: Update immediately to macOS Tahoe 26.6.1 or later, Sequoia 15.7.9 or later, or Sonoma 14.8.9 or later, and disable Screen Sharing if it is not required; never expose port 5900 directly to the public internet.
Apple has since released newer macOS security updates as well, so there is little reason to remain on the vulnerable builds.
Bugstoday Opinion
Apple loves making remote access look effortless.
Attackers apparently appreciated the effort.
A passwordless path into Screen Sharing that ends with root access is exactly the sort of bug that should make every Mac administrator check their firewall rules immediately.
The crypto miner is almost a joke compared with what root access actually gives an attacker.
Bugstoday verdict: if port 5900 is exposed, close it. If Screen Sharing is unnecessary, kill it. And if the Mac was exposed while vulnerable, don’t just patch it — check whether someone already walked through the door.
