Threat actors are actively exploiting a recently patched macOS vulnerability to gain root access and deploy cryptomining malware, according to the Dutch National Cyber Security Centrum (NCSC).

The flaw, tracked as CVE-2026-65400, is a high-severity authentication issue in macOS Screen Sharing that lets remote attackers log in without valid credentials. Apple disclosed the bug on August 6 and shipped fixes in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9.

About a week after the patch, NCSC warned that in-the-wild exploitation had begun, driven in part by a public proof-of-concept exploit. The agency said it received reports of active abuse on multiple systems where port 5900, the standard Screen Sharing port, was reachable from the internet. Attackers exploiting the flaw are gaining root access and installing a Monero miner, NCSC said.

Apple addressed the issue by improving state management to properly validate login credentials and block unauthorized authentication attempts, according to NCSC.

AI security firm Calif described the bug as trivial to exploit, noting that a remote attacker only needs to supply an account name to authenticate to a vulnerable system with Screen Sharing enabled. Since macOS displays usernames on its login window, the researchers noted that this is not a meaningful barrier for attackers.

Part of a Broader Pattern of screensharingd Bugs

CVE-2026-65400 is not the only vulnerability recently patched in screensharingd, the daemon that manages Screen Sharing connections. In late July, Apple quietly fixed at least four other issues in the component, three of which received CVE identifiers.

Security researcher osxreverser reported that the fourth and most severe issue, patched without a public advisory, allowed unauthenticated attackers to achieve remote code execution as root. According to the researcher, any macOS system with Screen Sharing enabled and System Integrity Protection (SIP) disabled could be taken over remotely, requiring only knowledge of the target’s IP address and no user interaction. The flaw reportedly allowed attackers to plant a reverse shell and a root crontab entry through a single connection.

On August 8, osxreverser warned that roughly 40,000 internet-accessible macOS systems had Screen Sharing enabled, leaving them potentially exposed to attack.

Recommendations

  • Apply macOS Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9 immediately
  • Disable Screen Sharing on systems that do not require remote access
  • Restrict or firewall port 5900 from internet exposure
  • Check systems for unauthorized cron jobs, reverse shells, or unexpected mining processes