CVE-2026-65400: Update macOS Screen Sharing

CVE-2026-65400 is an authentication vulnerability in macOS Screen Sharing, and it has moved from a patching concern to an active-exploitation incident. Apple fixed it on August 6, 2026, in macOS Sonoma 14.8.9, macOS Sequoia 15.7.9, and macOS Tahoe 26.6.1. If your Mac runs an earlier version and its Screen Sharing service is reachable over the network, install the relevant update immediately.

The risk is not that every Mac is automatically exposed. The important combination is a vulnerable macOS installation plus network reachability to Screen Sharing. The reported attacks involved systems where TCP port 5900 was accessible from the Internet.

What CVE-2026-65400 does

Apple describes CVE-2026-65400 as an authentication issue in macOS Screen Sharing that may allow an attacker on the network to authenticate without valid credentials. In plain English: the service’s authentication boundary could be crossed without a legitimate username and password.

The flaw is classified as CWE-287, or improper authentication. Apple addressed it through improved state management in the affected service. The practical takeaway is refreshingly simple, even if the vulnerability is not: the fix is the macOS update, not a new Screen Sharing password.

Why Internet-exposed TCP 5900 matters

macOS Screen Sharing uses a VNC/RFB-based remote-desktop service commonly associated with TCP port 5900. Network reachability is required for the attack path described in the advisories; the clearest danger is a Mac whose port 5900 is published directly to the Internet through a router or firewall.

The Netherlands National Cyber Security Centre, or NCSC-NL, reported active abuse on multiple systems with Internet-accessible port 5900. In every case reported to the agency, attackers obtained root access and installed a Monero cryptocurrency miner.

That observed outcome matters, but it should not be stretched into a claim that every vulnerable Mac will be compromised in exactly the same way. Root access can enable further abuse, but the reported incidents specifically established root access and Monero mining—not every possible follow-on action.

A Mac used only behind a network boundary is not in the same exposure position as one with Screen Sharing published to the public Internet. It is still important to patch: network reachability can come from more places than a home router, including organizational networks and other systems that can reach the service.

Affected and patched macOS versions

The current vulnerability record lists these affected ranges and fixed versions:

Apple released all three fixes on August 6, 2026. To check your Mac, open Apple menu > About This Mac and compare the installed version with the matching row. If the Mac is managed by an organization, the same check should be made through its software inventory or update process.

The safe target is the fixed version for your branch—not merely the newest version number you happen to recognize. Sonoma, Sequoia, and Tahoe use different version tracks, so the last digits matter.

What happened in the reported attacks?

NCSC-NL’s August 12 update said the vulnerability was being actively abused on multiple Internet-reachable systems. The cases reported to the agency all involved root access and a Monero miner placed on the affected Mac.

The current NVD record lists a CISA-ADP CVSS 3.1 score of 9.8 Critical. Earlier reporting and the NCSC-NL advisory cited 7.1. That older number is historical context; the current NVD-listed assessment is 9.8. The CVE was also added to CISA’s Known Exploited Vulnerabilities catalog on August 18, 2026, with an August 21, 2026, remediation deadline listed in the record.

Apple’s public description is narrower than the incident’s observed impact: it confirms the authentication problem and the state-management fix, while NCSC-NL documents what happened on the systems reported to it. Keeping those two facts separate avoids both extremes—underestimating the bug as a theoretical glitch or claiming that every vulnerable Mac has already been taken over.

What to do now

1. Install the matching Apple update. Update to macOS Sonoma 14.8.9, macOS Sequoia 15.7.9, or macOS Tahoe 26.6.1, depending on your branch.
2. Check whether Screen Sharing is needed. In macOS, open System Settings > General > Sharing. If you do not use Screen Sharing, turn it off.
3. Remove public access to TCP port 5900. Check router port forwarding and firewall rules. The service should not be directly exposed to the public Internet.
4. Use a private access path for remote administration. If remote control is required, avoid publishing the service directly. A private network overlay can provide reachability without placing TCP 5900 openly on the Internet, although Screen Sharing still has to be enabled for a client to use that Mac service.
5. Do not treat password changes as the main fix. Because the vulnerability affects the authentication path itself, changing allowed users or rotating a VNC password does not remove the vulnerable code. Patching is the primary remediation.

If you cannot update immediately, disabling Screen Sharing and blocking direct public access to TCP port 5900 reduce the attack path. They are interim measures, not substitutes for installing the Apple security update.

The bottom line

CVE-2026-65400 is serious because it combines an authentication flaw with documented exploitation against Internet-reachable Screen Sharing services. The response is not complicated: match your Mac to the fixed version, install the update, and stop exposing TCP port 5900 directly to the Internet. The reported Monero infections are a warning about what attackers did in observed cases—not a prediction that every Mac faces the same outcome.