Cybersecurity agencies, including the Netherlands National Cyber Security Centre (NCSC-NL), have issued urgent warnings regarding active macOS screen sharing bug. Tracked as CVE-2026-65400 (9.8/10 CVSS v3 score), the pre-authentication vulnerability allows remote attackers on a network to completely bypass authentication checks and hijack vulnerable Mac systems without requiring a valid username or password.
1. What Happened?
Bynerio Security researcher Alfredo Pesoli reported the flaw, which Apple addressed via emergency patches on August 6, 2026. However, threat intelligence feeds indicate that attackers quickly reverse-engineered the fix and began weaponizing the vulnerability against internet-exposed systems.
- Root Cause: The vulnerability resides in the `screensharing` system daemon, which manages remote desktop access via TCP port 5900. Errors in its handling of the Secure Remote Password (SRP) protocol and state management cause the service to treat unauthenticated connection attempts as valid, allowing cleartext control of the machine.
- No Prerequisites: Attackers do not need access to existing user credentials, VNC passwords, or local accounts to gain access. All that is required is an exposed IP address running the vulnerable service.
2. Active Attacks in the Wild
According to advisories published by the NCSC-NL and endpoint telemetry providers, threat actors are aggressively scanning the public internet for hosts listening on port 5900.
- Root Access Acquired: Once an vulnerable machine is contacted, attackers exploit the authentication logic to gain immediate root access.
- Monero Miner Injection: In reported incidents, the primary payload deployed by attackers has been unauthorized Monero (XMR) cryptocurrency miners, which consume system resources to mine crypto in the background.
- Potential for Further Payload Escalation: Because attackers achieve complete root execution, compromised devices can easily be used as pivot points for internal network espionage, credential harvesting, or ransomware deployment.
3. Affected Systems & Patches
Apple fixed the flaw by improving state management mechanisms within the Screen Sharing daemon.
Patch Availability
| macOS Version Line | Vulnerable Status | Patched Release
| macOS Tahoe (v26) | Vulnerable | Updated to 26.6.1 |
| macOS Sequoia (v15) | Vulnerable | Updated to 15.7.9 |
| macOS Sonoma (v14) | Vulnerable | Updated to 14.8.9 |
| macOS Ventura & Older | Vulnerable | Unsupported (No patch available)
4. Remediation Steps for Security Teams
If immediate updating is not possible, administrators should take defensive actions right away:
- Apply Security Updates: Immediately update all managed Macs to macOS 26.6.1, 15.7.9, or 14.8.9.
- Disable Screen Sharing: If a system cannot be updated immediately, turn off Screen Sharing by navigating to System Settings > General > Sharing and toggling Screen Sharing off.
- Block Port 5900 at Network Edge: Ensure perimeter firewalls block inbound traffic over TCP port 5900 to prevent external scanning and access.
- Audit for Compromise: Updating a device will fix the flaw, but it will not remove an existing infection. Audit systems for unexpected CPU spikes, unknown root processes, or unauthorized network connections originating from port 5900.
