Overview
Apple has patched CVE-2026-65400, a critical authentication flaw in the macOS Screen Sharing component. The flaw affects macOS Sonoma, Sequoia, and Tahoe. Shortly after the patch, active abuse of CVE-2026-65400 was reported in the wild, with attackers targeting Macs that had the Screen Sharing port (TCP 5900) reachable from the internet, obtaining root access, and installing a Monero cryptocurrency miner. Public proof-of-concept code for CVE-2026-65400 is also available, and reporting notes that AI-assisted tooling has sharply shortened the time between disclosure and a working exploit. Together, these factors raise the urgency for organizations running affected macOS versions to apply the update without delay.
Analysis
| CVE ID | Affected Products | Affected CPE | CWE ID |
|---|---|---|---|
CVE-2026-65400 |
Apple macOS Sonoma (before 14.8.9), macOS Sequoia (before 15.7.9), macOS Tahoe (before 26.6.1) |
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* | CWE-287 |
A recently patched security flaw in Apple macOS has come under active exploitation to deploy a cryptocurrency miner. Tracked as CVE-2026-65400, it is an improper authentication weakness (CWE-287) in the Screen Sharing component of macOS, Apple's built-in remote desktop service, which listens on TCP port 5900 and is based on the VNC protocol. The root cause is insufficient state management within the Screen Sharing authentication path: during the login exchange, the service's internal state can advance as though authentication had succeeded when it had not. As a result, an attacker on the network can reach an authenticated session without presenting valid credentials. Public technical reporting characterizes CVE-2026-65400 as a state-machine desynchronization, and notes that the only requirement is naming a valid account, which is not a secret and is often visible on the macOS login window.
The attack against CVE-2026-65400 is carried out over the network with low complexity and requires no user interaction. It is worth noting that CVE-2026-65400 is distinct from a separate pre-authentication issue in the Screen Sharing daemon that Apple addressed in the earlier macOS 26.6 release; the two flaws reside in the same source code area but are tracked separately. The vulnerability affects macOS Sonoma before 14.8.9, macOS Sequoia before 15.7.9, and macOS Tahoe before 26.6.1, and Apple resolved CVE-2026-65400 by improving the state management logic so that only valid credentials are accepted, and unauthorized authentication attempts are rejected.
Active exploitation of CVE-2026-65400 has been confirmed, with reports of abuse across multiple systems where port 5900 was internet-facing; in each case attackers gained root and installed a Monero crypto miner. Public reporting cautions that details on the timing, scale, and precise mechanism of these attacks remain limited, and that it is not established whether CVE-2026-65400 was exploited before the patch was available. Given the confirmed exploitation activity, organizations running affected macOS versions should update to the latest release without delay to stay protected.
Mitigation
Install Apple's emergency updates without delay: macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, or macOS Sonoma 14.8.9, depending on the version in use. These releases fix the CVE-2026-65400 authentication flaw and are the most effective way to close the exposure.
If patching cannot be done right away, turn off Screen Sharing by navigating to General > Sharing and toggling Screen Sharing off. Never expose TCP port 5900 directly to the internet; if remote access is required, place the service behind a VPN or SSH tunnel and limit it to trusted source addresses.
On systems that were internet-facing, look for indicators of the observed activity, such as unfamiliar processes consuming high CPU, unexpected cryptominer binaries, unexplained root-level activity, and unauthorized changes to sudoers or other privileged configuration. Systems confirmed as compromised should be isolated, investigated, and rebuilt rather than only cleaned.
Audit the environment for any Macs reachable from the internet on port 5900 and remove that exposure. Apply network segmentation and firewall rules so that remote desktop services are only reachable from managed, trusted networks.
Adversary Behavior
T1496.001 Compute Hijacking
T1588.006 Vulnerabilities
Sources
At Hive Pro, it is our mission to detect the most likely threats to your organization and help you prevent them before they happen.
Platform
Arbis AI
The HivePro Platform
Integrations
HiveForce Labs
Compare
vs Rapid7
vs Tenable
vs Qualys
vs Nucleus
Solutions
Attack Surface Mgmt
Multi-Env Scanners
Exposure Assessment
Security Intelligence
Threat Prioritization
Exposure Validation
By Role
CISO
Vulnerability Managers
