Tech and AI

Attackers exploit macOS screen sharing flaw to seize control of internet-facing Macs

By Staff Writer  |  17 August 2026

The Dutch national cyber security agency reports attacks in the wild on CVE-2026-65400, an authentication bypass in the macOS screen sharing service. On every compromised system it examined, the attacker had gained root access and installed a Monero cryptocurrency miner. Apple patched the flaw on 6 August.

The Netherlands National Cyber Security Centre updated its advisory on the flaw on 12 August to record attacks observed in the wild. The agency said it had received a notification showing active attacks on multiple systems where port 5900, the screen sharing port, was reachable from the internet. In every case root access had been obtained on the affected system and a Monero cryptocurrency miner had been installed.

The vulnerability, tracked as CVE-2026-65400 and rated 7.1 out of 10 for severity, sits in the authentication handling of the screen sharing service, which lets another computer view a Mac's screen and control its keyboard and mouse. Apple closed it on 6 August in macOS Tahoe 26.6.1, Sequoia 15.7.9 and Sonoma 14.8.9.

A login that never happened

Researchers at security company Huntress, whose write-up follows the public disclosure of the bug, trace the fault to the service's implementation of Secure Remote Password authentication. A frame-length validator returns a stale success state, so the service treats a connection that never authenticated as if it had, and the session continues without cryptographic protection. From there an attacker can read and write arbitrary files as root, and can turn that into full remote code execution by planting a startup task that calls back to a listener under the attacker's control.

The bypass works before any password is entered. It succeeds even where legacy VNC authentication is switched off and no user account is enabled for screen sharing access.

As this is a pre-auth bug, the usual hardening does not help: removing allowed user accounts, disabling legacy VNC password authentication, or rotating the VNC password have no effect.

Ryan Dowd, Principal Security Operations Center Analyst, Huntress

The disclosure unfolded across a fortnight. Apple's security releases of 27 July altered the vulnerable code path while fixing a separate screen sharing flaw, CVE-2026-43760. Two days later the researcher Pedro Vilaca published a post confirming that a pre-authentication bug in the daemon had been patched, alongside a proof of concept, and other researchers then reconstructed the underlying fault and extended it to code execution. Apple's 6 August updates closed it explicitly as CVE-2026-65400, and details were presented publicly at a security conference in the first week of August.

Who is actually exposed

Screen sharing is off by default on macOS, and home and office routers generally keep port 5900 closed to the outside world. The population at risk is narrower and more commercial: hosted bare-metal Mac services, which rent out machines for remote workloads, commonly provision them with SSH and screen sharing already enabled. Huntress says a search of the address ranges used by such providers shows tens of thousands of potentially exposed hosts, and that some providers were still building new machines from operating system images which predate the fix, so a freshly rented Mac can arrive vulnerable.

For now the observed payload is cryptocurrency mining, which steals processing power rather than data. The sharper risk is that the same access allows credential theft or any other malware an attacker cares to install, with root privileges and no user interaction.

Dowd's advice is blunt: "The takeaway here is: Update all of your macOS devices across the board, even if you don't think Screen Sharing has been enabled." Where patching is genuinely impossible, the service itself should be disabled until it is.

Any practice running Macs behind a router that has never had a port opened is unlikely to be affected. Anyone renting a hosted Mac, or administering one reachable from the internet, should check the build version today, and treat an unexplained spike in processor load as a reason to look for a miner that somebody else installed.