The critical authentication vulnerability CVE-2026-65400 (CVSS 9.8) in the Screen Sharing component of the macOS operating system is being actively exploited by attackers to gain root access and deploy Monero cryptominers. The National Cyber Security Centre of the Netherlands (NCSC-NL) has recorded cases of compromise on systems with open port 5900. Apple has released emergency updates for macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9 — all users with Screen Sharing enabled must update immediately or disable the feature.
The nature of the CVE-2026-65400 vulnerability
The vulnerability affects the authentication mechanism of the Screen Sharing component and allows an attacker on the network to authenticate to the built-in remote desktop service without presenting valid credentials. According to Apple’s classification, the issue is related to improper state management, which leads to desynchronization of the authentication state machine.
Apple has fixed the vulnerability by improving state management mechanisms to ensure proper credential validation and prevent unauthorized authentication attempts. The patch was released on 6 August 2026. Discovery of the vulnerability is credited to researcher Alfredo Pesoli from Bynario.
A key characteristic of this vulnerability is that it belongs to the class of logic errors. According to researchers from Calif, there is no need to bypass ASLR, manipulate the heap, or win a race condition. It is enough to send one or two packets in the correct order — and the target machine grants access. The exploit works on the first attempt on every unpatched system with Screen Sharing enabled.
Active exploitation and threat scope
According to the updated NCSC-NL advisory, the centre has received reports of active exploitation of the vulnerability on multiple systems where port 5900 (the standard VNC/Screen Sharing port) was accessible from the internet. In all recorded cases, attackers obtained root access to the compromised system and installed a Monero cryptocurrency miner.
It should be noted that at the time of publication there are no details about the exact start date of the attacks, their overall scale, or whether the vulnerability was exploited as a zero-day before the patch was released. It is also unknown whether the attackers’ activity is limited solely to cryptomining. The vulnerability has not yet been added to the CISA KEV catalog.
Important caveat: the statement about active exploitation is based on a single government advisory from NCSC-NL and has not been independently confirmed by either Apple or CISA. Nevertheless, given the triviality of exploiting the logic flaw and the critical CVSS score, the threat should be taken seriously.
Cluster of vulnerabilities in Screen Sharing
CVE-2026-65400 is not an isolated issue. According to researchers, it is part of a series of vulnerabilities in the Screen Sharing Server component, some of which were previously fixed in macOS Tahoe 26.6:
- CVE-2026-43779 (CVSS 9.8) — a logic error that allows an application to intercept network connections intended for another process
- CVE-2026-43777 (CVSS 7.5) — an unspecified issue that allows a remote attacker to cause a denial of service
- CVE-2026-43760 (CVSS 8.6) — an access control flaw that allows an application to obtain access to a user’s sensitive data
Of particular note is the relationship between CVE-2026-65400 and a separate pre-authentication vulnerability in the screensharingd daemon, which was independently reported by a researcher under the pseudonym @osxreverser. According to his description, this vulnerability allowed an attacker to compromise any Mac with Screen Sharing enabled, knowing only its IP address — without a password or any other data. This vulnerability was fixed in macOS 26.6.
According to Calif’s analysis, both vulnerabilities are located in the same source file. The first (@osxreverser’s vulnerability) is a return value bug: the length check when processing an overly large frame exits early and returns the success code from the previous read operation, which the calling code interprets as successful completion of the authentication step. The second (CVE-2026-65400) is a state machine desynchronization that requires knowledge of the account name, which is not a serious barrier, since macOS displays user names on the login screen.
The role of AI in accelerating exploitation
Also noteworthy is Calif’s statement that an AI agent created working exploits for both vulnerabilities in four hours. Although this claim comes from a single source and cannot be independently verified, it illustrates a worrying trend: logic errors that do not require complex techniques for bypassing defensive mechanisms are particularly vulnerable to automated analysis. Calif reports that for this reason the company is refraining from publishing full technical details of CVE-2026-65400 until most users have installed the updates.
Impact assessment
The highest risk is faced by macOS systems with Screen Sharing or Remote Management enabled that are accessible from the internet via port 5900. According to unconfirmed reports on social networks, about 40,000 such hosts have been found on the internet, primarily in the United States, including university and corporate systems. This figure should be treated with caution — it is based on a single social media post without supporting data.
Obtaining root access through this vulnerability means complete compromise of the system. Although the activity observed so far is limited to cryptomining, the same attack vector could be used for data theft, installation of backdoors, lateral movement within the network, and deployment of ransomware.
Recommendations for protection
- Update macOS immediately to the latest versions: macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, or macOS Sonoma 14.8.9
- If you cannot update right now — disable Screen Sharing: System Settings → General → Sharing → toggle Screen Sharing to “Off”
- Check whether port 5900 is accessible from external networks. Remote access services should not be directly exposed to the internet — use a VPN or SSH tunneling
- Audit systems on which Screen Sharing was enabled and port 5900 was reachable from outside for signs of compromise: unauthorized processes, unknown entries in sudoers, presence of cryptomining processes
- Review logs for suspicious connections to port 5900 from unknown IP addresses
The combination of factors — trivial exploitation, critical CVSS 9.8 score, confirmed active exploitation, and the presence of multiple related vulnerabilities in a single component — makes updating macOS and auditing Screen Sharing configuration a top-priority task. Organizations using macOS in corporate environments should consider a complete ban on direct Screen Sharing access from external networks at the firewall level, regardless of update status.
