A critical vulnerability has been identified in Apple’s macOS Screen Sharing, revealing a method for executing root commands by exploiting a logic flaw. Originally designed to provide screen-viewing access, this flaw transforms the feature into a gateway for unauthorized root command execution.
Understanding the Vulnerability
The flaw, cataloged as CVE-2026-43760, impacts the screensharingd service and associated file transfer utilities, SSFileCopySender and SSFileCopyReceiver, on macOS systems. This occurs when Screen Sharing or Remote Management is active, with the legacy VNC password option enabled.
At the heart of the issue is the Screen Sharing service’s handling of two distinct authentication processes. When users authenticate through Apple’s native system, their actions are correctly executed based on their user permissions. However, using the outdated VNC authentication method bypasses this control, as it does not link to a specific macOS user account. Consequently, file operations continue with root privileges.
Exploiting the Flaw
This flaw enables a remote user to exploit the screen sharing service in two ways. First, by requesting SSFileCopySender to retrieve files, including those restricted to root access, such as /etc/sudoers. Second, SSFileCopyReceiver allows writing files to any specified directory with root permissions.
Researchers from Bynar demonstrated the flaw by injecting a new file into /private/etc/sudoers.d, effectively granting passwordless sudo access to a non-admin account. This manipulation facilitated opening a root shell remotely through an authenticated Screen Sharing session, without traditional exploitation techniques like memory corruption.
Impact and Mitigation
While Apple has classified the flaw as a means for apps to access sensitive data, experts argue it significantly understates the potential impact, highlighting the risk of arbitrary root file creation and command execution. Independent evaluations have assigned it a CVSS 3.1 score as high as 8.8, contrasting Apple’s lower rating of 5.5.
To address this, Apple released patches for macOS Tahoe 26.6 and macOS Sonoma 14.8.8 on July 27, 2026. Users are strongly advised to apply these updates. For those unable to update immediately, disabling the VNC password option or turning off Screen Sharing and Remote Management is recommended. Changing the VNC password alone does not resolve the issue.
This case highlights a growing trend in cybersecurity, where attackers shift focus from memory safety vulnerabilities to logic and authorization flaws. As traditional exploitation becomes more challenging, these types of vulnerabilities represent a new frontier for both defenders and attackers.
