AppYour homeOperatorJournalAlerts
Request an introduction
Security issueApple

CVE-2026-65400

A flaw in macOS Screen Sharing that lets an attacker on the network in without a password. Apple fixed it on 6 Aug 2026. It’s being used in attacks.

CVE-2026-65400Screen Sharing
Attacks
Used in attacksOn CISA's list of flaws used in attacks since 18 Aug 2026. Every Apple flaw on the list
Affected
  • macOS Tahoe before 26.6.1
  • macOS Sequoia before 15.7.9
  • macOS Sonoma before 14.8.9
Fixed in
macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Golden Gate 27
Severity
Apple doesn’t rate severity. CVSS 9.8 out of 10 (critical), scored by CISA.
Official name
Apple macOS Improper Authentication Vulnerability
What's known.From Apple’s security notes, CISA's catalogue of exploited flaws and NVD, checked 23 Oct 2026.

What it is

Screen Sharing lets someone see and control a Mac from another computer. Apple says this flaw lets an attacker on the network authenticate to Screen Sharing without valid credentials: no password needed. It's an authentication flaw, so there's no booby-trapped file or web page involved; the attacker only needs to reach the Mac over a network.

It only matters on Macs with Screen Sharing turned on. It's off unless someone switched it on, in System Settings, General, Sharing.

Is it being used in attacks?

Yes. CISA, the US cybersecurity agency, added it to its catalogue of known exploited vulnerabilities on 18 Aug 2026, 12 days after the fix. CISA lists a flaw only when it has reliable evidence of it being exploited, and gave US federal agencies until 21 Aug 2026 to fix it. Apple’s own note doesn’t mention attacks.

Neither Apple nor CISA has said who was attacked or how.

What to do

  1. Update macOS, then restart.System Settings → General → Software Update. Tahoe needs 26.6.1, Sequoia needs 15.7.9 and Sonoma needs 14.8.9, or later.
  2. If nobody uses Screen Sharing, turn it off.System Settings → General → Sharing → Screen Sharing. One fewer way in, whatever the next flaw is.

Advisories that include it

  1. macOS Sequoia before 15.8.1

Sources

  1. About the security content of macOS Tahoe 26.6.1The fix, and what Apple says it does.support.apple.com ·
  2. About the security content of macOS Sequoia 15.7.9The fix, and what Apple says it does.support.apple.com ·
  3. About the security content of macOS Sonoma 14.8.9The fix, and what Apple says it does.support.apple.com ·
  4. About the security content of macOS Golden Gate 27The fix, and what Apple says it does.support.apple.com ·
  5. Known Exploited Vulnerabilities catalog: CVE-2026-65400Added 18 Aug 2026: CISA has evidence it is being used in attacks.cisa.gov ·
  6. CVE-2026-65400The official description, and a CVSS score of 9.8 out of 10 from CISA.nvd.nist.gov ·
Every advisoryLook up any app, company or CVEThe HARD Mac app links its warnings here.