Threat actors are exploiting a recently patched macOS vulnerability to gain root access and deploy cryptominers on vulnerable systems. The bug, tracked as CVE-2026-65400, is an authentication issue in Screen Sharing that allows remote attackers to log in without valid credentials.
The vulnerability has been observed being exploited by threat actors roughly a week after Apple rolled out fixes for it in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9 on August 6. The Dutch National Cyber Security Centrum (NCSC) has confirmed that active exploitation of the vulnerability has been observed on multiple systems with port 5900 accessible from the internet.
According to security researchers at Calif, the flaw allows a remote attacker to authenticate to a macOS system with Screen Sharing enabled simply by naming an account. “Naming an account is the one thing the bug needs,” they note. “It’s not much of a barrier. A username is not a secret, and macOS prints them on the login window.” This means that anyone with knowledge of a valid username can exploit the vulnerability.
The CVE-2026-65400 is just one of several recently patched vulnerabilities in screensharingd, the daemon responsible for managing Screen Sharing connections. Apple patched at least four other issues in it, including three that have CVE identifiers. The most severe of these was reportedly silently addressed and allowed unauthenticated attackers to gain remote code execution as root.
Security researcher osxreverser has warned that approximately 40,000 internet-accessible macOS systems had Screen Sharing enabled, making them potentially exposed to attacks. The flaw did not require user interaction and could allow an attacker to plant a reverse shell and a root crontab through the same connection.
The exploitation of this vulnerability is particularly concerning given the existence of a public proof-of-concept (PoC) exploit that has been widely available since Apple patched the issue. This means that threat actors have had access to the necessary tools to exploit the vulnerability, which increases the likelihood of successful attacks.
This incident serves as a reminder that patching vulnerabilities in a timely manner is crucial for preventing exploitation. macOS users should ensure they are running the latest version of their operating system and that Screen Sharing is properly configured to prevent unauthorized access. Furthermore, it highlights the importance of security researchers disclosing vulnerabilities responsibly and providing timely patches to mitigate potential damage.
MacOS users with Screen Sharing enabled should take immediate action to secure their systems by updating their operating system to the latest version and ensuring proper configuration of Screen Sharing settings. Additionally, it is essential for organizations to regularly review their network configurations and ensure that all services are properly secured against unauthorized access.
Source: SecurityWeek — 2026-08-17