Apple macOS Screen Sharing Flaw Exploited on Internet
Actively exploited CVE-2026-65400 in macOS Screen Sharing grants pre-auth root access; attackers deploy Monero miners on exposed systems.
NCSC-NL reported active exploitation of CVE-2026-65400 (CVSS 9.8), an authentication flaw in macOS Screen Sharing patched on August 6, 2026, with root access gained and a Monero miner planted on internet-exposed systems using port 5900. Related Screen Sharing bugs CVE-2026-43779, CVE-2026-43777, and CVE-2026-43760 were fixed in macOS Tahoe 26.6, and researcher @osxreverser noted a pre-auth flaw fixed alongside them affecting roughly 40,000 exposed hosts. Calif said an AI agent produced working exploits for both pre-auth bugs in four hours, underscoring the shrinking gap between patch release and weaponization.
- Patched August 6 in macOS Tahoe 26.6.1, Sequoia 15.7.9, Sonoma 14.8.9
- Exploitation targets hosts with port 5900 exposed; root access and Monero mining observed
- ~40,000 screen-sharing hosts exposed online, nearly half in the US
- Working AI-built exploit for both flaws produced in four hours
- Mitigation if unpatched: disable Screen Sharing
- Vendors
- Apple
- Products
- macOSScreen Sharing
- Countries
- Netherlands
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-43779+2 related CVEs | A logic issue was addressed with improved restrictions | 9.8 group max | <1% | ||
| CVE-2026-65400 | Authentication Bypass in Apple macOS Screen Sharing | 9.8 | 2% | KEV | KEV |
From the original article
5 min read at thehackernews.com
A recently patched security flaw in Apple macOS has come under active exploitation in the wild to deploy a cryptocurrency miner, the Netherlands National Cyber Security Centre (NCSC-NL) has warned . The vulnerability in question is CVE-2026-65400 (CVSS score: 9.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.