Apple macOS Screen Sharing Flaw CVE-2026-65400 Is Being Exploited to Hijack Macs
Apple has patched a macOS Screen Sharing flaw that attackers are now actively exploiting on internet-exposed Macs to gain root access and install Monero cryptocurrency miners.
The creepy part is how little an exposed Mac may need to give attackers an opening, and the fix is already sitting in Software Update.
➜ The real story: Screen Sharing is supposed to make remote access convenient, but leaving it exposed to the public internet just turned convenience into a root-level invitation.
Apple macOS CVE-2026-65400 Screen Sharing Flaw Is Under Active Attack
Apple fixed CVE-2026-65400 on August 6 in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9.
The bug sits in the Screen Sharing authentication process and can allow an attacker on the network to get in without valid credentials.
The story got more serious after active exploitation was observed on multiple Macs with port 5900 reachable from the internet.
In those cases, attackers obtained root access and dropped a Monero miner onto the machines.
Apple Mac Security Is Moving Faster as AI Speeds Up Exploit Development
This also lands right after a broader round of Apple and Microsoft critical security updates for August 2026, which makes August feel less like routine patch season and more like a reminder that remote access services deserve extra attention.
Apple has also been dealing with a separate Apple Private Cloud Compute security flaw tied to Apple Intelligence infrastructure, so the security conversation around the company is wider than one Screen Sharing bug.
Neither issue means Macs are suddenly unsafe by default. It does mean current software and sane network exposure matter a lot more than the old idea that Macs somehow sit outside the usual security mess.
There’s another piece worth watching: the speed between a vulnerability becoming public and somebody building a working exploit.
One security team said it produced working exploits for related Screen Sharing flaws in about four hours with an AI agent.
That doesn’t mean AI created this attack campaign, but it does show how much faster exploit development can move now.
The patch window is getting compressed, which makes delaying a security update a much less casual choice than it used to be.
How to Fix the Apple macOS Screen Sharing Security Flaw
For most Mac users, the fix is simple: install the newest macOS update available for your machine.
If you can’t patch right away, turn off Screen Sharing in System Settings under General, then Sharing, especially if the Mac is reachable from outside your local network.
If you actually need remote access, keep it behind a properly secured network or another protected access layer instead of exposing Screen Sharing directly to the internet.
The good news is that Apple already shipped the fix, so acting now can actually close the door.
FAQs
What is CVE-2026-65400 in Apple macOS?
CVE-2026-65400 is a macOS Screen Sharing authentication flaw that can let a network attacker authenticate without valid credentials on an unpatched Mac.
Which macOS updates fix CVE-2026-65400?
Apple fixed the flaw in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9.
What should Mac users do about the Screen Sharing flaw?
Install the latest macOS update. If you can’t patch immediately, disable Screen Sharing and avoid exposing the service directly to the public internet.
