A significant security vulnerability in Apple’s macOS operating system has emerged, allowing attackers to deploy cryptocurrency mining software on affected systems. This issue, identified as CVE-2026-65400, was disclosed by the Netherlands National Cyber Security Centre (NCSC-NL), which confirmed active exploitation of the flaw.
Understanding the CVE-2026-65400 Vulnerability
The flaw, with a CVSS score of 9.8, is an authentication issue in the Screen Sharing component of macOS. It permits unauthorized access to the remote desktop feature, enabling attackers within the network to bypass credential verification. Apple has released updates to address this flaw, enhancing state management to block unauthorized authentication attempts. These patches were issued in an emergency update for macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9.
Apple acknowledged the vulnerability in an advisory on August 6, 2026, crediting Alfredo Pesoli of Bynario for the discovery. The NCSC-NL’s follow-up advisory revealed that systems with internet-exposed port 5900 were being compromised to install Monero mining software.
Implications and Related Vulnerabilities
While details on the exploitation timeline remain unclear, the NCSC-NL notes potential for broader attacks beyond cryptocurrency mining. Additional issues in Apple’s Screen Sharing Server component have been identified and patched. These include CVE-2026-43779, CVE-2026-43777, and CVE-2026-43760, which concern logic, unspecified, and access issues respectively.
Researcher Alfredo Pesoli provided technical insights into CVE-2026-43760, highlighting a legacy authentication path that could lead to unauthorized file operations and remote command execution. Another researcher, known as @osxreverser, pointed out a pre-authentication vulnerability in the Screen Sharing daemon, allowing unauthorized access without a password.
Preventive Measures and Future Outlook
To mitigate risks, users should promptly update their systems with the latest security patches. Disabling Screen Sharing can also serve as a temporary protective measure. Calif, a security firm, has withheld further details on CVE-2026-65400 to allow time for user updates, emphasizing the ease of exploit development using AI.
This incident underscores the accelerating pace of cyber threats facilitated by AI, highlighting the need for vigilant system updates and robust cybersecurity practices. Users are urged to ensure their systems are up-to-date to safeguard against these vulnerabilities.
