senn-techApple macOS CVE-2026-65400: Screen Sharing Without a Password
A new macOS security update closes a vulnerability that sounds benign but has far-reaching consequences: CVE-2026-65400 affects the Screen Sharing service screensharingd and allows an attacker to open a VNC session without a valid password — with root privileges.
What happens in practice
The screensharingd service listens for incoming VNC connections on port 5900. Because of the flaw in the authentication flow, an attacker can skip the password check and establish an active remote-management session. That is equivalent to local root access: anyone who can view and control the desktop can run arbitrary commands, read files, and establish persistence.
- CVE-2026-65400 in
screensharingd. - CVSS 9.8, rescored from an initial 7.1 rating.
- Active exploitation confirmed by NCSC-NL.
- Added to the CISA KEV catalog on August 18, 2026.
- Observed follow-up activity: installation of a Monero miner on compromised devices.
Affected versions and patch
Apple patched the flaw on August 6, 2026. The following versions are explicitly affected:
| macOS version | Status |
|---|---|
| macOS Tahoe 26.6.1 | Patch available |
| macOS Sequoia 15.7.9 | Patch available |
| macOS Sonoma 14.8.9 | Patch available |
The update should be prioritized on any system with reachable Screen Sharing. The service is disabled by default, but if you enabled it for remote administration, the system is exploitable on the local network as soon as port 5900 is reachable.
Exploitability and risk
The deciding factor is network access to port 5900. This is enough on the internal network or through a VPN connection. Once the port is reachable, the attacker needs neither valid credentials nor user interaction. The session is established directly with system privileges.
NCSC-NL has classified the vulnerability under active-exploitation considerations. In observed cases, the shell obtained after takeover was used to install a Monero miner — a classic pattern after successful compromise.
Immediate actions
- Apply the security update — this is the only complete remediation.
- Disable Screen Sharing until the patch is installed.
- Block port 5900 if Screen Sharing cannot be turned off immediately.
- Review logs for unusual VNC connections and unknown processes.
- Look for Monero-mining indicators: high CPU load, unexpected processes, unusual network connections.
Further reading
Which macOS versions are affected by CVE-2026-65400?+
According to Apple's August 6, 2026 security update, macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9 are affected. The vulnerability resides in screensharingd, the service that handles VNC connections. Any unpatched system running one of these versions with Screen Sharing enabled is exploitable.
Why was the CVSS score raised from 7.1 to 9.8?+
The initial assessment underestimated the impact. The bypass lets an unauthenticated attacker with network access take over a root VNC session. That equals full compromise without valid credentials, which maximizes the CVSS ratings for confidentiality, integrity, and availability.
What should I do immediately if Screen Sharing is enabled?+
Install the security update first. Until then, disable Screen Sharing in System Settings or block inbound port 5900 on the firewall. You should also check for unusual VNC connections on the network and look for indicators such as unexpected processes or high CPU usage.