What happened
Apple patched CVE-2026-65400 on 6 August in macOS Tahoe 26.6.1 and earlier releases after network-based exploitation of the flaw was observed in the wild. The vulnerability resides in macOS Screen Sharing, the built-in remote desktop feature that exposes VNC over TCP port 5900. The defect allows an unauthenticated remote attacker to gain access without valid credentials and to open applications remotely and access files on the affected system.
Public exploit code for the issue emerged alongside reports of active abuse. In the observed incidents root had been accessed on the affected systems and a Monero cryptocurrency miner had been placed.
Apple addressed CVE-2026-65400 with releases that improve state management mechanisms to enforce correct credential validation and prevent rogue authentication attempts. The fix is included in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9.
Technical details
CVE-2026-65400 is a flaw in the macOS Screen Sharing service that handles incoming VNC connections on TCP port 5900. The defect is in the service’s state management for authentication, which allows the credential validation sequence to be reached in an unexpected state during a network session.
Under the vulnerable conditions an unauthenticated remote actor can complete the VNC handshake without presenting valid credentials and obtain an interactive session on the target. Once the session is established the attacker can launch applications remotely and read files accessible to the service process, with observed post-compromise activity reaching root-level access on affected hosts.
Exploitation is network-based and does not require user interaction. Public exploit code appeared in parallel with in-the-wild reports, and the observed intrusions involved placement of a Monero cryptocurrency miner after privilege escalation.
Who is affected
CVE-2026-65400 affects macOS systems with the built-in Screen Sharing service enabled and reachable over the network. The vulnerable configurations are macOS Tahoe 26.6 and earlier, macOS Sequoia 15.7.8 and earlier, and macOS Sonoma 14.8.8 and earlier. Any host that exposes VNC on TCP port 5900 without the August 6 updates is in scope for unauthenticated remote access.
In-the-wild abuse has been observed against internet-exposed Macs where Screen Sharing is active. The observed post-compromise activity includes root-level access on affected hosts and deployment of a Monero cryptocurrency miner. The exposure puts interactive desktop sessions, locally accessible files and privileged system operations at risk for users and organizations that rely on macOS endpoints.
What to do
Defenders should update affected macOS endpoints immediately to the patched releases issued on 6 August. Apple has shipped the fix in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9. Systems that cannot be updated right away should have Screen Sharing disabled where it is not required for business use, and inbound access to TCP port 5900 should be blocked at the perimeter firewall or host-based firewall for any Mac that does not need remote desktop.
Network teams should treat internet-exposed VNC on port 5900 as high risk until patched and review perimeter logs for unsolicited connection attempts to that port from external addresses. Endpoint monitoring should look for unexpected launches of remote desktop sessions, privilege escalation events, and the creation or execution of mining-related processes and binaries commonly associated with Monero miners observed in post-compromise activity.
Apple recommends upgrading to one of the fixed releases to restore correct credential validation in the Screen Sharing service. Organizations with managed fleets should verify patch compliance for macOS Tahoe 26.6 and earlier, macOS Sequoia 15.7.8 and earlier, and macOS Sonoma 14.8.8 and earlier, and re-enable Screen Sharing only after the update is confirmed.
Key points
- Active exploitation of CVE-2026-65400 in macOS Screen Sharing is underway following public release of exploit code.
- The vulnerability allows network-based attackers to gain access without valid credentials via VNC on TCP port 5900.
- Compromised systems show root access obtained and a Monero crypto miner placed on the affected host.
- Apple fixed the flaw on August 6 in macOS Tahoe 26.6.1 and earlier releases, improving state management to enforce correct credential validation.
- Patched releases include macOS Tahoe 26.6.1, macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9.
Further reading & sources
- Hackers exploit macOS Screen Sharing flaw to deploy Monero miner — BleepingComputer