macOS Screen Sharing Flaw CVE-2026-65400 Hits CISA's KEV List as Attackers Mine Monero on Exposed Macs

On August 6, 2026, Apple quietly fixed a bug in macOS Screen Sharing and it was rated CVSS 7.1 — high, not urgent. Eight days later, CISA rewrote the score to 9.8 critical, with no new technical finding attached. Four days after that, on August 18, the CVE landed on the CISA Known Exploited Vulnerabilities (KEV) catalog next to a Microsoft SharePoint bug and a VMware vCenter path-traversal flaw — because the Dutch National Cyber Security Centre had already watched attackers walk onto internet-exposed Macs with no password at all, get root, and install a Monero miner.

A 7.1 that became a 9.8 without a new bug

NVD's own change history for the CVE shows no NVD-assigned score at all — the base score is attributed entirely to CISA's Vulnrichment program (CISA-ADP). The vector CISA published on August 6 read AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N — network attack, low complexity, but low privileges required and only partial integrity/availability impact. On August 14, CISA replaced it outright with AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: no privileges required, full impact across confidentiality, integrity and availability. Tom's Hardware independently reported the same 7.1→9.8 jump, attributing it to CISA reassessing the bug as fully automatable — not to any change in the underlying code Apple shipped.

Where the authentication check actually fails

According to Huntress's technical writeup, the flaw sits in screensharingd's handling of Apple's native Secure Remote Password (SRP) authentication. The daemon's frame-length validator erroneously returns a stale "success" status before the SRP handshake has actually completed, so the connection gets treated as authenticated even though it isn't. The resulting session also never negotiates encryption — investigators saw this in Endpoint Security telemetry as authentication_type: SRP instead of the legitimate RSA-SRP, confirming the cryptographic handshake never finished. Public proof-of-concept work moved fast: researcher Pedro Vilaça (fG!) first published an obfuscated read-only PoC (navi_the_clown), and researcher bl4sty reverse-engineered it into a fuller read/write-plus-RCE chain with a reverse shell.

Confirmed in the wild, not hypothetical

• NCSC-NL received a report of exploitation on multiple systems that had port 5900 reachable from the internet — in every case reported, attackers obtained root access.
• Following root compromise, attackers deployed a Monero cryptominer on the affected systems.
• Microsoft separately confirmed exploitation on a limited number of macOS devices, observing successful root sign-ins via Screen Sharing.
• Post-compromise activity included transferring scripts and an SSH key, establishing SSH persistence, removing histories and logs, and modifying Packet Filter (pf) firewall settings.
• The cryptominer (XMRig 6.26.0) was disguised as a hidden binary masquerading as the Apple system process com.apple.airportd, with LaunchDaemon persistence.

The rest of that day's KEV batch

What to do

1. Patch: update to macOS Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9.
2. If you can't patch immediately, disable Screen Sharing (System Settings → General → Sharing) or block inbound TCP/5900 at the network edge.
3. On any Mac that has had Screen Sharing reachable from the internet, hunt for the IoCs NCSC-NL and Microsoft described: unexpected SSH keys or persistence, edited pf rules, wiped shell history, an XMRig process disguised as com.apple.airportd, and unfamiliar LaunchDaemons.
4. Treat any host you can't rule out as compromised — rotate any credentials that touched it and rebuild if root access is confirmed. Removing accounts or rotating the VNC password after the fact does not undo an already-established root foothold.

KEV addition and CVSS rescore confirmed as of 2026-08-18live record →