macOS Screen Sharing Flaw Exploited to Deploy Monero Miners
Dutch NCSC confirms active exploitation of critical macOS Screen Sharing flaw CVE-2026-65400, granting root access and installing Monero miners.
CVE-2026-65400 (CVSS 9.8) is an authentication state-management flaw in macOS's built-in Screen Sharing that lets network attackers authenticate without valid credentials. The Dutch NCSC confirmed active exploitation against systems with port 5900 exposed to the internet; in every documented case attackers obtained root access and installed a Monero cryptocurrency miner. Apple patched the bug in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9, crediting Alfredo Pesoli of Bynario. A related researcher scan found roughly 40,000 exposed Screen Sharing hosts, and security firm Calif built working exploits for related flaws in about four hours using an AI coding agent.
- CVE-2026-65400 (CVSS 9.8) lets network attackers authenticate to Screen Sharing without valid credentials
- Patched in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9; researcher credited
- NCSC-NL reports root access and Monero miner deployment on internet-exposed port 5900 systems
- Scan found ~40,000 exposed Screen Sharing hosts; Calif built exploits in hours with AI
- CVEs
- CVE-2026-65400
- Products
- macOS
- Malware
- Monero miner
- Countries
- Netherlands
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-65400 | Authentication Bypass in Apple macOS Screen Sharing | 9.8 | 2% | KEV | KEV |
From the original article
3 min read at securityaffairs.com
Hackers are exploiting a macOS Screen Sharing flaw to gain root access and install Monero miners on Macs with port 5900 exposed online. The Dutch National Cyber Security Centre confirmed active exploitation of a critical macOS authentication flaw, tracked as CVE-2026-65400 (CVSS score of 9. 8), less than two weeks after Apple shipped the fix.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.