Cyber attackers are exploiting a high-severity flaw in macOS Screen Sharing to gain full root access and install Monero miners. Security experts warn that thousands of systems remain exposed despite available patches.
- CVE-2026-65400 allows remote attackers to bypass authentication in macOS Screen Sharing.
- Hackers are gaining root access to install Monero cryptominers on vulnerable systems.
- Apple has released critical updates for macOS Tahoe, Sequoia, and Sonoma.
- Approximately 40,000 internet-accessible macOS systems were found with Screen Sharing enabled.
A critical security flaw in the macOS Screen Sharing feature is currently being exploited by threat actors to seize complete control of affected systems. The vulnerability, tracked as CVE-2026-65400, is a high-severity authentication bypass that allows remote attackers to log into a system without needing valid credentials, provided the Screen Sharing feature is enabled and accessible via the internet.
The Dutch National Cyber Security Centrum (NCSC) has confirmed active in-the-wild exploitation. According to their findings, attackers are targeting systems where port 5900 is open to the internet. Once inside, the attackers elevate their privileges to root level, granting them total administrative control over the machine. This access is primarily being used to deploy Monero miners, which hijack the system's CPU resources to mine cryptocurrency for the attackers.
Why This Matters
BozokMedia analysis shows that this exploit is particularly dangerous because the barrier to entry is incredibly low. According to the security firm Calif, an attacker only needs to know a valid account name—which is often displayed on the macOS login window—to authenticate. This transforms a sophisticated attack into a trivial task for script kiddies and organized cybercrime groups alike.
The existence of a public proof-of-concept (PoC) exploit has drastically shortened the window between patch release and active exploitation, making immediate updates non-negotiable.
Beyond CVE-2026-65400, the screensharingd daemon has been a hotspot for vulnerabilities. In late July, Apple patched four additional issues, one of which was a silent fix for a critical remote code execution (RCE) flaw. Security researcher osxreverser noted that this specific RCE could allow attackers to plant a reverse shell and a root crontab, effectively creating a permanent backdoor into the system if System Integrity Protection (SIP) was disabled.
The scale of the risk is significant. Reports indicate that roughly 40,000 macOS systems globally have Screen Sharing enabled and are exposed to the public internet, leaving them as sitting ducks for automated scanning tools used by hackers.
| Vulnerability | Impact | Requirement | Status |
|---|---|---|---|
| CVE-2026-65400 | Root Access / Miner | Account Name | Patched |
| Silent RCE Flaw | Remote Code Execution | IP Address + SIP Disabled | Patched |
Frequently Asked Questions
Q1: How can I protect my Mac from this vulnerability?
The most effective way is to update your macOS to the latest version (Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9) and disable Screen Sharing if you do not explicitly need it.
Q2: What is port 5900 and why is it a risk?
Port 5900 is the default port used for VNC/Screen Sharing. If this port is open to the internet, anyone globally can attempt to connect to your machine.
