{"id":"macos-screen-sharing-auth-bypass-aug-2026","category":"patch","status":"closed","title":"Apple macOS Screen Sharing sign-in bypass (CVE-2026-65400) exploited to install cryptominers; fixed","tldr":"A flaw in macOS Screen Sharing (CVE-2026-65400) let attackers sign in without a password. It is being used against Macs exposed to the internet. Update to macOS 26.6.1 or later, 15.7.9 or 14.8.9, and switch Screen Sharing off if you don't need it.","summary":"CVE-2026-65400 is an authentication flaw in Screen Sharing, the remote-viewing feature built into macOS. A person on the network could sign in without valid credentials. Apple fixed it on 6 August 2026 in macOS Tahoe 26.6.1, Sequoia 15.7.9 and Sonoma 14.8.9, crediting researcher Alfredo Pesoli of Bynario Atlas. The Netherlands' NCSC raised its rating on 12 August as exploitation reports came in. Help Net Security reports that attackers used it against Macs with Screen Sharing reachable from the internet on port 5900, gained root access and installed a Monero cryptominer. CISA added it to its list of exploited flaws on 18 August with a CVSS score of 9.8. Apple's own advisories do not say the flaw was used in attacks. The fix is also in macOS Tahoe 26.7 (14 September), and CISA's entry lists macOS 27 as fixed. Changing passwords does not stop the attack, and updating does not clean a Mac that was already compromised. Public proof-of-concept code is reported to exist.","action":"Update your Mac in System Settings under General, then Software Update, to the latest version for your release (at least 26.6.1, 15.7.9 or 14.8.9). If you don't use Screen Sharing, turn it off under General, then Sharing, and never expose port 5900 to the internet. If a Mac was reachable and unpatched, ask an IT professional to check it.","product":"Apple macOS (Tahoe 26, Sequoia 15, Sonoma 14) Screen Sharing","audience":"both","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-65400"],"tags":["apple","macos","screen-sharing","authentication-bypass","exploited","cisa-kev","cryptominer"],"affected":["macOS Sonoma 14 before 14.8.9","macOS Sequoia 15 before 15.7.9","macOS Tahoe 26 before 26.6.1"],"fixed":["macOS Sonoma 14.8.9","macOS Sequoia 15.7.9","macOS Tahoe 26.6.1","macOS Tahoe 26.7"],"matches":[{"platform":"macos","app":"macOS Sonoma 14","bundle":"","fixed":"14.8.9"},{"platform":"macos","app":"macOS Sequoia 15","bundle":"","fixed":"15.7.9"},{"platform":"macos","app":"macOS Tahoe 26","bundle":"","fixed":"26.6.1"}],"sources":[{"kind":"advisory","title":"About the security content of macOS Tahoe 26.6.1","url":"https://support.apple.com/en-us/148170","by":"Apple","date":"2026-08-06"},{"kind":"advisory","title":"About the security content of macOS Sequoia 15.7.9","url":"https://support.apple.com/en-us/148171","by":"Apple","date":"2026-08-06"},{"kind":"advisory","title":"About the security content of macOS Sonoma 14.8.9","url":"https://support.apple.com/en-us/148172","by":"Apple","date":"2026-08-06"},{"kind":"advisory","title":"About the security content of macOS Tahoe 26.7","url":"https://support.apple.com/en-us/149042","by":"Apple","date":"2026-09-14"},{"kind":"advisory","title":"About the security content of macOS 27","url":"https://support.apple.com/en-us/149035","by":"Apple","date":"2026-09-14"},{"kind":"news","title":"Attackers exploit patched macOS Screen Sharing flaw to deploy cryptominer","url":"https://www.helpnetsecurity.com/?p=381918","by":"Help Net Security","date":"2026-08-17"},{"kind":"advisory","title":"Known Exploited Vulnerabilities Catalog","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","by":"CISA","date":"2026-08-18"}],"started":"2026-08-06","closed":"2026-09-14","created":"2026-11-03T21:42:46.657Z","updated":"2026-11-03T21:42:46.657Z","cve_notes":[{"cve":"CVE-2026-65400","name":"Sign-in bypass in macOS Screen Sharing","what":"An authentication flaw in Screen Sharing, macOS's remote-viewing feature, that lets an attacker on the network sign in without valid credentials and, as reported, gain root access.","severity":"critical","cvss":9.8}],"timeline":[{"at":"2026-09-14","added":"2026-11-03T21:41:32.717Z","kind":"new-fix","text":"Apple released macOS Tahoe 26.7, which also lists the fix under the Screen Sharing Server component (advisory page published 26 October). macOS 27 was released the same day; CISA's entry lists it as fixed, but I did not find the CVE in the part of Apple's macOS 27 advisory I could read.","url":"https://support.apple.com/en-us/149042","by":"Apple","patch":"patched"},{"at":"2026-08-18","added":"2026-11-03T21:41:32.717Z","kind":"cisa-added","text":"CISA added CVE-2026-65400 to its Known Exploited Vulnerabilities catalogue, rating it CVSS 9.8.","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","by":"CISA","patch":null},{"at":"2026-08-17","added":"2026-11-03T21:41:32.717Z","kind":"wider-attacks","text":"Help Net Security reported that attackers were using the flaw against Macs with Screen Sharing reachable from the internet on port 5900, gaining root access and installing a Monero cryptominer. The NCSC had not said whether attackers did anything further.","url":"https://www.helpnetsecurity.com/?p=381918","by":"Help Net Security","patch":null},{"at":"2026-08-12","added":"2026-11-03T21:41:32.717Z","kind":"wider-attacks","text":"The Netherlands' NCSC, which had published an advisory on 7 August, raised its severity rating as reports of exploitation arrived. Help Net Security says public proof-of-concept code had appeared before the exploitation reports.","url":"https://www.helpnetsecurity.com/?p=381918","by":"Help Net Security","patch":null},{"at":"2026-08-06","added":"2026-11-03T21:41:32.717Z","kind":"disclosed","text":"Apple released macOS Tahoe 26.6.1, Sequoia 15.7.9 and Sonoma 14.8.9, fixing CVE-2026-65400, a Screen Sharing flaw that let a network attacker sign in without valid credentials. Apple credited Alfredo Pesoli of Bynario Atlas and did not say it was being used in attacks.","url":"https://support.apple.com/en-us/148170","by":"Apple","patch":"patched"}],"url":"https://hard.fyi/live/macos-screen-sharing-auth-bypass-aug-2026/","json":"https://hard.fyi/api/live?id=macos-screen-sharing-auth-bypass-aug-2026"}