Cybersecurity agencies have issued urgent warnings following evidence that threat actors are actively exploiting a zero-day security flaw in Apple's macOS Screen Sharing service. The vulnerability allows remote attackers to bypass authentication controls and gain complete control over exposed systems without needing a password.
Reports indicate that bad actors are targeting vulnerable devices connected to the internet, leveraging the flaw to establish root-level access and install unauthorised cryptocurrency mining software. Apple has released emergency software patches, and security experts urge all Mac users to update their operating systems immediately.
macOS screen sharing vulnerability exploited by cybercriminals
The flaw, identified as CVE-2026-65400, stems from an authentication-bypass weakness within the built-in Screen Sharing service in macOS. Under normal circumstances, remote access through Screen Sharing requires valid user credentials to initiate a session. However, due to a failure in session state management, attackers on a reachable network can trick the system into granting full access without authenticating.
Because the Screen Sharing feature operates with elevated system privileges, successful exploitation gives adversaries complete administrative control. They can view the user's screen, capture keystrokes, extract sensitive files, and execute arbitrary commands. The vulnerability affects systems where port 5900 is accessible over the network or exposed directly to the public internet.
Overview of CVE-2026-65400 on macOS
Cybersecurity researchers first flagged the underlying authentication logic in late July, leading to detailed public analyses of the service daemon. Security analysts noted that the bug specifically impacts how macOS implements its Secure Remote Password protocols during handshakes.
When an attacker connects to an unpatched device running the vulnerable service, manipulating the state management sequence allows them to bypass password prompts entirely. The National Vulnerability Database assigned the flaw a high severity score due to its ease of exploitation and the lack of user interaction required.
How the Screen Sharing Authentication Flaw Works
At its core, the vulnerability breaks the standard verification logic used during network handshakes. The Screen Sharing daemon fails to validate whether a remote client has successfully completed the authentication sequence before granting access to the desktop environment.
By sending specially crafted network packets to port 5900, a remote user can force the service into an authenticated state. This grants full remote desktop control, allowing the attacker to interact with the device as if they were sitting directly in front of the display.
Active Exploitation and Monero Cryptominer Attacks
Government security agencies, including the Dutch National Cyber Security Centre, confirmed that malicious groups are actively exploiting the vulnerability in the wild. Attackers have been scanning public IP ranges to identify Mac devices with exposed Screen Sharing ports.
In documented intrusion cases, the primary payload delivered following unauthorized access has been Monero cryptocurrency mining malware. Because Monero mining relies heavily on general-purpose processor performance, Apple silicon chips present an attractive target for illicit mining operations.
Security analysts emphasize that while cryptocurrency miners are currently the primary payload, root-level compromise allows for far more damaging activity. Threat actors with root access can harvest login credentials, exfiltrate personal files, install persistent backdoors, or use compromised machines as launching pads for internal network attacks.
Apple's Security Patch in macOS Tahoe 26.6.1
Apple addressed the flaw by releasing emergency software updates across supported operating system versions. The fix resolves the issue by enforcing stricter state management checks during the Screen Sharing authentication sequence.
The security patches are available in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9. System administrators and individual owners running any of these major operating system versions are advised to apply the updates without delay.
Recommended Action for Mac Users
To defend against active exploitation, users should verify that their systems are running the latest software updates by navigating to System Settings, choosing General, and selecting Software Update. Installing the latest build closes the security gap immediately.
Additionally, administrators should review local network configurations. Screen Sharing should never be exposed directly to the public internet without a virtual private network or secure SSH tunnel. Disabling Screen Sharing when it is not actively required provides an essential extra layer of defense against remote network threats.
Closing Summary
The active exploitation of CVE-2026-65400 highlights the significant risks posed by exposed remote management services. Because attackers can gain root privileges without password verification, updating affected devices remains the single most effective step to secure systems against ongoing automated scans and unauthorized control.
