CVE-2026-65400 is an authentication flaw in Apple's Screen Sharing component, rated CVSS 9.8. It lets an attacker on the network authenticate to the remote desktop service without valid credentials.
Apple shipped emergency patches on 6 August 2026. The Netherlands National Cyber Security Centre has confirmed active exploitation across multiple internet-exposed systems.
Affected and fixed
| macOS | Fixed in |
|---|---|
| Tahoe | 26.6.1 |
| Sequoia | 15.7.9 |
| Sonoma | 14.8.9 |
Reported to Apple by Alfredo Pesoli of Bynario. Three related flaws in the same component were fixed alongside it — CVE-2026-43779, CVE-2026-43777 and CVE-2026-43760.
What the exploitation looked like
The precondition is port 5900 exposed to the internet. Where that was true, per the reporting:
root had gained access to the affected system and placed a Monero crypto miner
Root access on a Mac, used to mine Monero.
There is a temptation to read cryptojacking as the harmless outcome. It is better read as a capability indicator. Whoever ran this had unauthenticated root on every exposed machine they touched. Mining is what they chose to do with it; it is not the ceiling of what they could have done.
It is also the loudest possible use of that access. A miner pegs the CPU and shows up in fan noise and battery life. An operator interested in the data would have been quieter, and might still be there.
Why 5900 is open at all
Screen Sharing is macOS's built-in VNC service. Nobody deliberately publishes it to the internet — it gets there through:
- A router with UPnP enabled, forwarding automatically
- A port-forward set up years ago for remote access from home
- A Mac on a cloud or colocation host with no firewall in front of it
- A small office where "let me just get in from outside" was solved once and never revisited
That is the same population as the water systems reached through exposed controllers and the Android TV boxes with ADB open: devices nobody administers, with a service enabled by default or turned on once for convenience.
What to do
- Update now. 26.6.1, 15.7.9 or 14.8.9 depending on your line. This is an emergency patch and the flaw is being exploited.
- Turn Screen Sharing off if you do not use it — System Settings, then General, then Sharing. This is the complete fix and most people will never notice it is gone.
- Check whether 5900 is reachable from outside. If you have any Mac on a public IP, or a router doing UPnP, assume it might be until you have checked.
- Look for a miner before assuming you were fine. Sustained high CPU with no explanation, an unfamiliar launch agent or daemon, outbound connections to mining pools. A patched machine that was exposed last week was not necessarily patched in time.
What is not established
- How many systems were hit. NCSC-NL confirmed exploitation across multiple internet-exposed systems and gave no count.
- Whether this was exploited as a zero-day. NCSC-NL did not say, and the timing relative to the 6 August patch is not public.
- Who is behind it. No attribution has been offered, and cryptojacking rarely produces one.
- Whether mining was the only payload. Nothing rules out something quieter alongside it.
