- The Mess: Apple’s Screen Sharing service has a nasty authentication flaw tracked as CVE-2026-65400, and attackers are already using it against Internet-exposed Macs. The vulnerability can let an attacker authenticate without valid credentials and reach root-level access.
The vulnerable component is macOS Screen Sharing, the built-in service that lets users remotely control a Mac.
Normally, an attacker reaching TCP port 5900 still has to get through authentication.
CVE-2026-65400 breaks that assumption.
Apple described the issue as an authentication problem caused by improper state management. Security researchers later reconstructed the attack and found that specially crafted authentication traffic could push the Screen Sharing service into an authenticated state without a legitimate password.
That’s bad enough.
Then the privilege boundary gets worse.
Researchers found a path from the Screen Sharing service into privileged helper functionality, allowing attackers to obtain root access on vulnerable systems.
Root on macOS means essentially game over.
- The Damage: Attackers can remotely control a vulnerable Mac, access files, modify the system, install persistence and deploy malware — and real-world incidents have already resulted in Monero cryptominers being installed.
The Dutch National Cyber Security Centre reported multiple incidents involving systems with Screen Sharing exposed directly to the public Internet.
In the observed cases, attackers gained root access and installed Monero mining software.
That makes the vulnerability particularly interesting from a defensive perspective.
The attackers didn’t need a phishing campaign.
They didn’t need to steal an Apple password.
They didn’t need the victim to open a malicious document.
They simply found an exposed remote-administration service.
And there are plenty of machines where that service exists because someone wanted convenient remote access to a Mac mini, workstation, development machine or server.
The vulnerable versions were fixed by Apple in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9.
Any earlier build in those affected branches should be treated as vulnerable.
- The Fix: Update macOS immediately, stop exposing Screen Sharing/VNC directly to the Internet, and investigate TCP 5900 connections, unusual Screen Sharing sessions, root activity and unexpected cryptocurrency-mining processes.
The safest architecture is simple: don’t publish Screen Sharing directly to the Internet.
Use a VPN or another properly secured remote-access layer instead.
Administrators should also check whether vulnerable Macs were reachable from untrusted networks before they were patched. Updating a compromised machine does not magically remove an attacker who already installed persistence.
Apple’s security update fixed the authentication flaw, but incident response still matters for systems that were exposed while vulnerable.
Bugstoday Opinion
Apple users sometimes get the luxury of believing that Linux gets hacked because it’s complicated and Windows gets hacked because it’s everywhere.
Then macOS opens port 5900 and hands someone root.
CVE-2026-65400 is a perfect reminder that built-in remote administration is still attack surface.
The interesting part isn’t that macOS had a vulnerability. Every serious operating system does.
The interesting part is what happened next.
Attackers found Internet-exposed machines, bypassed authentication, reached root and installed cryptominers.
No phishing.
No stolen password.
No user interaction.
Just an exposed service and a broken authentication state machine.
If Screen Sharing is sitting on the public Internet, it isn’t remote administration anymore.
It’s a target.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
Apple — macOS Security Updates
CVE-2026-65400 — CVE Record
NVD — National Vulnerability Database
Netherlands National Cyber Security Centre — CVE-2026-65400 Advisory
Malwarebytes — macOS Screen Sharing Exploitation Analysis
