CVE-2026-65400

This is a weakness in macOS that can let an attacker enter your Screen Sharing feature without knowing your password. Think of it like a “locked door” that sometimes still opens if the attacker times it right on the network.

Once inside, attackers can take over the machine and have been reported installing a cryptominer (software that uses your computer’s power to mine cryptocurrency).

This matters if you run macOS versions prior to macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, or macOS Tahoe 26.6.1 and use or expose Screen Sharing.

The risk applies when an attacker can reach Screen Sharing over the network (for example, the commonly reachable port 5900, including internet-exposed setups). It does not require the attacker to have a login or user interaction—only network reachability.

This is RED because active exploitation has been reported in the real world, including outcomes like root access and deployment of a Monero cryptominer.

Even without public exploit code on record, the combination of password-bypass behavior and real incidents means you should treat vulnerable systems as already being targeted where Screen Sharing is reachable.

1. Confirm exposure on each Mac

   • Check macOS version on every Mac:
     • Vulnerable if older than:
       • Sequoia 15.7.9
       • Sonoma 14.8.9
       • Tahoe 26.6.1
   • Check whether Screen Sharing is enabled.
   • Identify whether it’s reachable from other networks:
     • The reporting notes port 5900 can be reachable on internet-exposed systems; verify whether your firewall/router exposes Screen Sharing externally.

2. Upgrade to the fixed macOS version

   • Upgrade any affected Macs to one of the fixed versions:
     • macOS Sequoia 15.7.9
     • macOS Sonoma 14.8.9
     • macOS Tahoe 26.6.1
   • Apple’s remediation guidance is linked in the vendor fix cards referenced for this CVE.
   • After the upgrade, restart the Mac(s).

3. Temporary containment if you can’t patch immediately

   • Disable Screen Sharing on the affected Mac(s).
   • Block inbound access to Screen Sharing from the internet/firewall so it is not reachable externally (and ideally restrict it to only trusted internal networks, if you must use it).

4. Validate that the threat didn’t already land

   • Look for signs of compromise reported with this issue:
     • Unexpected processes or services running cryptocurrency mining activity.
     • Strange persistence mechanisms or scheduled tasks (if your organization has a baseline for what’s normal).
   • If you find indicators, isolate the host from the network and involve your IT/security support promptly.

5. What to monitor after remediation

   • Network logs for any attempts to connect to Screen Sharing.
   • System activity around the timeframe of the latest patching.

CISA KEV

• This CVE is not listed in the CISA KEV set based on the provided findings.

Severity is effectively critical given the reported outcomes and high-impact access: an authentication bypass in macOS Screen Sharing allows an attacker to gain full access to the user’s screen sharing session and potentially the computer itself.

Mechanism/weakness: CWE-287 indicates flawed state management. The issue is described as improved authentication state handling being required; prior to the fixed macOS versions, the authentication state can be managed in a way that allows login to Screen Sharing without valid credentials.

Attack vector and reachability: Network-based access. No authentication is required from the attacker, and user interaction is not required. Preconditions specify that the attacker must be on the same network; reporting also highlights internet-exposed setups with port 5900 reachable.

Exploitation status: Real-world exploitation has been reported, including root access and installation of a Monero cryptominer on multiple affected systems. No public exploit code is on record.

KEV: Not listed in CISA KEV (per findings).

EPSS: A predicted likelihood score is provided (not treated as decisive in light of exploitation reporting).