Critical macOS Screen Sharing Authentication Bypass — Under Active Exploitation (CVE-2026-65400)

On August 6, 2026, Apple shipped an emergency, out-of-band fix for CVE-2026-65400, an authentication issue in screensharingd, the daemon behind Screen Sharing, macOS's built-in remote desktop service that listens on TCP port 5900. Apple's advisory describes an attacker who could reach the service over the network and authenticate without valid credentials, then read and write files as root—enough to achieve full remote code execution. The fix landed in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9, roughly ten days after Apple's regular July update had already patched three other, separate Screen Sharing bugs.

The Netherlands National Cyber Security Centre (NCSC-NL) first flagged the vulnerability on August 7 and, in an August 12 update, reported active exploitation: on every internet-exposed Mac it investigated with port 5900 reachable, attackers had gained root access and installed a Monero cryptocurrency miner, and public proof-of-concept code was by then available. CISA rescored the CVE from 7.1 to 9.8 (Critical) on August 14, replacing a vector that assumed an attacker needed some privileges with one requiring none and granting full compromise, and added the flaw to its Known Exploited Vulnerabilities catalog on August 18. That same day, Microsoft Security Intelligence reported observing exploitation on a limited number of macOS devices: after gaining root access through Screen Sharing, attackers transferred an SSH public key and scripts to the device, established SSH persistence, cleared logs and history, modified packet filter settings, and deployed the XMRig 6.26.0 cryptocurrency miner as a hidden .config/sysmond binary masquerading as com.apple.airportd, persisted via a KeepAlive LaunchDaemon.

What the vulnerability is

screensharingd is the macOS daemon behind Screen Sharing, the built-in VNC-based remote desktop service that listens on TCP/5900. CVE-2026-65400 lets a network attacker complete authentication to that service without a valid password, then abuse the resulting session to read protected files and write attacker-controlled files as root, which is sufficient to achieve remote code execution as root. No local access or user interaction is required, only network reachability to the service. Mapped to MITRE ATT&CK, the relevant techniques are T1190 (Exploit Public-Facing Application) for the initial access vector, T1098.004 (SSH Authorized Keys) and T1543.004 (Create or Modify System Process: Launch Daemon) for the persistence observed in the wild, and T1496 (Resource Hijacking) for the cryptomining payload.

Key facts to keep in mind

The only requirement is network access to port 5900 on the target Mac: the attacker doesn't need a valid username or password, doesn't need to already be logged into or running code on the machine, and doesn't need the victim to click or approve anything.
The exposed surface is any Mac with Screen Sharing enabled and port 5900 reachable from an untrusted network, most acutely the open internet.
Once exploited, an attacker has full root access, meaning no file or system function is off-limits. In observed attacks, that access was used to install a hidden SSH key for persistent remote access and to deploy a Monero cryptocurrency miner.
Fixed in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9 (August 6, 2026). CISA rescored the CVSS from 7.1 to 9.8 (Critical) on August 14 and added it to the KEV catalog on August 18, with a federal remediation deadline of August 21, 2026.
Endpoints with Screen Sharing disabled are not exploitable via this vector, even if unpatched, though the vulnerable code is still present until the update is applied.

How Tanium can help

Tanium Guardian: The CVE-2026-65400 dashboard charts current Screen Sharing status across the fleet and surfaces the ones that are actually exposed: unpatched endpoints that also have Screen Sharing enabled. Deploy the "Disable Screen Sharing [macOS]" package directly from the dashboard as an interim mitigation on endpoints that don't rely on the feature (it's off by default on fresh installs); patching remains the primary fix.

Tanium Comply: Run a vulnerability assessment and filter findings for CVE-2026-65400 to see current counts and confirm which endpoints still need the update to macOS Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9. Re-run the assessment after patching to confirm each finding has cleared.

Tanium Patch: Customers managing Macs via MDM can deploy the update as an Update in the Patch workbench; macOS updates in Tanium Patch are delivered as MDM commands, so most customers won't need separate enrollment or tooling to get endpoints onto Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9.

Tanium Interact: Run the dashboard's pre-built Interact Questions to hunt for the persistence pattern reported in the wild.

References

Guardian Research Team

The Guardian Research Team is a specialized group of cybersecurity experts tasked with identifying, analyzing, and providing actionable intelligence on critical, emerging, and zero-day threats.