Exploited in the wild macOS auth-bypass Screen Sharing Apple malware
Apple macOS Screen Sharing Flaw Exploited on Internet-Exposed Macs to Install Monero Miner
CVE Tools coverage
The Dutch National Cyber Security Centre (NCSC) has confirmed that CVE-2026-65400, a critical authentication bypass in Apple macOS Screen Sharing, is being actively exploited to deploy cryptocurrency mining software. This flaw, rated 9.8 on the CVSS scale, permits attackers to gain unauthorized root access to remote desktop services without valid credentials, particularly affecting Macs with port 5900 exposed to the internet.
Apple released emergency patches for this vulnerability in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. Users should immediately apply these updates or disable Screen Sharing via System Settings to mitigate the risk of compromise.