Security researchers have identified that a newly patched macOS vulnerability is being exploited by cybercriminals to gain root access and install cryptominers on targeted systems. The flaw, known as CVE-2026-65400, presents a significant authentication problem within the Screen Sharing feature, allowing unauthorized remote logins.
Vulnerability Details and Exploit
Apple addressed this high-severity issue on August 6 with updates for macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9. However, the Dutch National Cyber Security Centrum (NCSC) reported active exploitation of the flaw shortly after the patch was released. This rapid exploitation was enabled by the availability of a public proof-of-concept exploit.
The NCSC highlighted that the vulnerability allows threat actors to gain root access and deploy Monero miners on vulnerable systems. The exploitation primarily occurs on computers where port 5900 is open and accessible via the internet.
Apple’s Response and Security Measures
In response to the threat, Apple has enhanced its state management processes to ensure proper validation of login credentials, aiming to prevent unauthorized access attempts. Yet, the simplicity of the attack, which only requires the attacker to know a user’s account name, remains a concern as account names are typically displayed on the login screen.
AI security firm Calif noted that the bug’s exploitation hinges on naming an account, a task made easier by macOS’s default display settings. Despite the patch, the vulnerability’s ease of exploitation underscores the importance of applying updates promptly.
Additional Vulnerabilities and Warnings
This vulnerability is not isolated; in July, Apple addressed several other issues in the screensharingd daemon, one of which was particularly severe, enabling unauthenticated remote code execution. Security expert osxreverser revealed that an estimated 40,000 macOS systems with Screen Sharing enabled were at risk, emphasizing the potential scale of the threat.
The exposed systems could be compromised without user interaction, allowing attackers to establish a reverse shell or manipulate root-level tasks. This highlights the ongoing need for vigilance and regular system updates to mitigate such security risks.
Related vulnerabilities, such as those in Adobe Commerce and WordPress, further illustrate the critical nature of timely patch management to protect against evolving cyber threats.
