Threat Summary
On August 6, 2026, Apple released a security patch addressing CVE-2026-65400. This vulnerability is a pre-authentication authentication bypass in the macOS Screen Sharing service (screensharing, VNC, TCP port 5900). threat actors can remotely connect and gain root access without credentials. This flaw assessed at CVSS 9.8 (Critical) is under active exploitation, primarily to plant Monero (XMRig) cryptominers on user devices, with the potential for broader malware deployment and data theft.
Affected macOS versions include Tahoe <26.6.1, Sequoia <15.7.9, and Sonoma <14.8.9. Unpatched internet-exposed Macs are at greatest risk. The Dutch NCSC has confirmed exploitation in the wild and CISA has assessed this vulnerability at CVSS 9.8 Critical.
Exploitation requires minimal attacker effort. Any remote party able to access port 5900 TCP on a vulnerable Mac can instantly bypass authentication, escalate privileges to root, and execute arbitrary commands, including installing persistent backdoors and miners. With proof-of-concept available, organizations must assume scanning and exploitation are ongoing at scale.
Immediate action is required. Patch deployment should be prioritized for any system with Screen Sharing enabled, especially if accessible over the internet or in multi-user campus, corporate, or lab environments. Interim mitigations and monitoring should be enabled pending full roll-out of updates.
Recommendations
Patch Immediately:
- Upgrade all affected systems to:
- macOS Tahoe 26.6.1 or later
- macOS Sequoia 15.7.9 or later
- macOS Sonoma 14.8.9 or later
- Download updates from Apple’s official update channels if not automatically received.
Disable Screen Sharing:
- If patching cannot be performed immediately, disable Screen Sharing:
- System Settings → General → Sharing → Toggle Screen Sharing off.
- Or via command: sudo launchctl disable system/com.apple.screensharing
- Alternatively, launchctl unload -w /System/Library/LaunchDaemons/com.apple.screensharing.plist
Restrict Network Access:
- Use firewalls to block inbound access to TCP/5900 from untrusted networks.
- Only allow VNC/Screen Sharing over secure VPN/SSH if organizationally required.
Implement Long-Term Hardening:
- Enforce regular OS/software patching cycles.
- Harden endpoint firewall defaults (stealth mode, restrict service sharing, etc.).
- Use MDM solutions to centrally disable Screen Sharing where not needed, or restrict features (e.g., copy/paste, file transfer) in environments where necessary.
- Enable System Integrity Protection (SIP) and TCC controls on all Macs.
- Favor secure remote access protocols (VPN, SSH, MDM remote).
Temporary Workarounds
If patching is delayed or operationally infeasible:
Disable Screen Sharing entirely:
- Via System Settings (see above) or Terminal (see above commands).
- Unload the daemon for persistent disable: launchctl unload -w /System/Library/LaunchDaemons/com.apple.screensharing.plist
Network Restriction:
- Block inbound connections to port 5900 at organizational firewalls and endpoint firewalls.
Automated Compliance:
- Use CIS/DoD STIG compliance checks:
- Verify status with: launchctl print-disabled system | grep -c ‘”com.apple.screensharing” => disabled’
MDM Controls:
- For large organizations, enforce Screen Sharing restrictions via MDM configuration profiles (macOS 14+).
Dynamic Script for Temporary Enable/Disable:
- Provide simple scripts to toggle Screen Sharing for administrative use, ensuring it is not inadvertently left enabled (see full script under “Workarounds” in findings above).
Limitations:
- Disabling Screen Sharing may disrupt legitimate remote-support work.
- Network-based blocking does not prevent local attacks; it is only effective if port 5900 is not exposed to untrusted networks.
- Note that these are only stopgap measures; the patch remains the definitive fix.
References:
- https://thehackernews.com/2026/08/apple-macos-screen-sharing-flaw.html
- https://www.huntress.com/blog/macos-screen-sharing-rce-patched
- https://www.tomshardware.com/tech-industry/cyber-security/macos-screen-sharing-flaw-exploited-to-root-macs-and-plant-monero-miners
- https://nvd.nist.gov/vuln/detail/CVE-2026-65400
- https://www.automox.com/worklets/disable-screen-sharing-mac
