Apple macOS Screen Sharing sign-in bypass (CVE-2026-65400) exploited to install cryptominers; fixed
A flaw in macOS Screen Sharing (CVE-2026-65400) let attackers sign in without a password. It is being used against Macs exposed to the internet. Update to macOS 26.6.1 or later, 15.7.9 or 14.8.9, and switch Screen Sharing off if you don't need it.
Update your Mac in System Settings under General, then Software Update, to the latest version for your release (at least 26.6.1, 15.7.9 or 14.8.9). If you don't use Screen Sharing, turn it off under General, then Sharing, and never expose port 5900 to the internet. If a Mac was reachable and unpatched, ask an IT professional to check it.
- macOS Sonoma 14fixed in 14.8.9 and later
- macOS Sequoia 15fixed in 15.7.9 and later
- macOS Tahoe 26fixed in 26.6.1 and later
What’s happening
CVE-2026-65400 is an authentication flaw in Screen Sharing, the remote-viewing feature built into macOS. A person on the network could sign in without valid credentials. Apple fixed it on 6 August 2026 in macOS Tahoe 26.6.1, Sequoia 15.7.9 and Sonoma 14.8.9, crediting researcher Alfredo Pesoli of Bynario Atlas. The Netherlands' NCSC raised its rating on 12 August as exploitation reports came in. Help Net Security reports that attackers used it against Macs with Screen Sharing reachable from the internet on port 5900, gained root access and installed a Monero cryptominer. CISA added it to its list of exploited flaws on 18 August with a CVSS score of 9.8. Apple's own advisories do not say the flaw was used in attacks. The fix is also in macOS Tahoe 26.7 (14 September), and CISA's entry lists macOS 27 as fixed. Changing passwords does not stop the attack, and updating does not clean a Mac that was already compromised. Public proof-of-concept code is reported to exist.
- What
- Flaw
- Affects
- Apple macOS (Tahoe 26, Sequoia 15, Sonoma 14) Screen Sharing
- Affected
- macOS Sonoma 14 before 14.8.9
macOS Sequoia 15 before 15.7.9
macOS Tahoe 26 before 26.6.1 - Fixed in
- macOS Sonoma 14.8.9
macOS Sequoia 15.7.9
macOS Tahoe 26.6.1
macOS Tahoe 26.7 - Since
- 6 Aug 2026
- Closed
- 14 Sept 2026
Timeline
- New fixFixed
Apple released macOS Tahoe 26.7, which also lists the fix under the Screen Sharing Server component (advisory page published 26 October). macOS 27 was released the same day; CISA's entry lists it as fixed, but I did not find the CVE in the part of Apple's macOS 27 advisory I could read.
- CISA added
CISA added CVE-2026-65400 to its Known Exploited Vulnerabilities catalogue, rating it CVSS 9.8.
- Wider attacks
Help Net Security reported that attackers were using the flaw against Macs with Screen Sharing reachable from the internet on port 5900, gaining root access and installing a Monero cryptominer. The NCSC had not said whether attackers did anything further.
- Wider attacks
The Netherlands' NCSC, which had published an advisory on 7 August, raised its severity rating as reports of exploitation arrived. Help Net Security says public proof-of-concept code had appeared before the exploitation reports.
- Made publicFixed
Apple released macOS Tahoe 26.6.1, Sequoia 15.7.9 and Sonoma 14.8.9, fixing CVE-2026-65400, a Screen Sharing flaw that let a network attacker sign in without valid credentials. Apple credited Alfredo Pesoli of Bynario Atlas and did not say it was being used in attacks.
Sources
- About the security content of macOS Tahoe 26.6.1Apple · 6 Aug 2026
- About the security content of macOS Sequoia 15.7.9Apple · 6 Aug 2026
- About the security content of macOS Sonoma 14.8.9Apple · 6 Aug 2026
- About the security content of macOS Tahoe 26.7Apple · 14 Sept 2026
- About the security content of macOS 27Apple · 14 Sept 2026
- Attackers exploit patched macOS Screen Sharing flaw to deploy cryptominerHelp Net Security · 17 Aug 2026
- Known Exploited Vulnerabilities CatalogCISA · 18 Aug 2026