CVE-2026-65400 (CVSS 9.8): Attackers Are Silently Rooting Macs via Screen Sharing — 40,000 Hosts Exposed, Monero Miners Deployed

Your Mac’s built-in remote access feature just became a skeleton key for cryptojackers. CVE-2026-65400, a pre-authentication bypass in macOS Screen Sharing, lets any attacker on the network gain root-level access without a password — no credentials, no phishing, no malware dropper required. Active exploitation has been confirmed, approximately 40,000 hosts were exposed on the public internet at peak, and the attackers’ immediate prize is your CPU cycles mining Monero cryptocurrency. Apple patched on 6 August 2026; CISA rescored the flaw to CVSS 9.8 Critical on 14 August and formally added it to the Known Exploited Vulnerabilities (KEV) catalogue on 18 August. If your organisation runs macOS endpoints, this is a fire-drill moment.

How a Single Wrong Return Value Opens the Door to Root

The macOS Screen Sharing service (screensharingd) implements the Secure Remote Password (SRP) protocol to authenticate remote users before granting desktop access over the Remote Framebuffer (RFB) protocol on TCP port 5900. Researchers at Huntress describe the root cause with striking precision: “a single wrong return” in the daemon’s state-machine validation — the frame-length validator erroneously returns a stale success status after a crafted packet sequence, causing screensharingd to treat the connection as fully authenticated when it is not. Sessions subsequently proceed without cryptographic protection, in plaintext.

What makes CVE-2026-65400 especially dangerous is what happens immediately after. The SSFileCopySender helper process spawned by screensharingd inherits the kTCCServiceSystemPolicyAllFiles entitlement — the same Full Disk Access privilege that Apple’s Transparency, Consent, and Control (TCC) framework is supposed to gate behind an explicit user prompt. An unauthenticated attacker therefore bypasses both the authentication layer and TCC in a single exploit, gaining the ability to read any file on the filesystem and write data to privileged paths.

Three companion vulnerabilities were silently patched alongside CVE-2026-65400: CVE-2026-43779 (CVSS 9.8), which introduces a logic flaw enabling process-level network interception; CVE-2026-43760 (CVSS 8.6), a confused-deputy condition enabling post-authentication file access escalation; and CVE-2026-43777 (CVSS 7.5), a remote denial-of-service condition. Apple’s 6 August security release was larger than the headline CVE suggested.

The Anatomy of an Active Attack: From Port Scan to Monero Miner

The Dutch National Cyber Security Centre (NCSC-NL) disclosed active exploitation on 12 August 2026 after investigating several compromised macOS systems. Forensic reconstruction shows a methodical, low-noise attack chain:

1. Reconnaissance: Mass-scan for TCP/5900 on the public internet. Censys data at the time of disclosure identified approximately 40,000 macOS hosts with Screen Sharing directly internet-facing — roughly half in the United States, with the remainder spanning academic institutions, cloud-hosted Mac infrastructure, and commercial entities globally.
2. Authentication bypass: The attacker sends a crafted SRP packet sequence, triggering the frame-length validation bug. The daemon transitions to an authenticated session state without any cryptographic exchange.
3. Persistence establishment: Using the RFB session, the attacker transfers an SSH public key and setup scripts to the device, establishes SSH-based re-entry for persistence, then clears shell history and system logs to impede forensic investigation.
4. TCC and firewall evasion: Packet Filter rules are modified to suppress outbound traffic alerts. The inherited kTCCServiceSystemPolicyAllFiles entitlement is abused to write files to protected system directories.
5. Cryptomining payload: XMRig 6.26.0 is deployed as a hidden binary at ~/.config/sysmond, masquerading as com.apple.airportd — a legitimate Apple process name unlikely to trigger manual review. A KeepAlive LaunchDaemon plist ensures the miner auto-restarts on reboot. Monero (XMR) was chosen deliberately: its CryptoNight algorithm is optimised for general-purpose CPUs, making stolen Mac compute cycles directly monetisable without specialised hardware. As Bitdefender noted, Monero does not depend on ASICs — any compromised Mac contributes meaningfully to a mining pool.

The attack leaves no ransom note, no defaced files, no obvious indicator of compromise for non-technical users. Victims typically discover it through anomalous CPU load, unexpected electricity bills, or EDR alerts — often days or weeks after initial compromise.

CISA’s Unusually Swift Re-Rating and the KEV Clock

Apple’s initial advisory assigned CVE-2026-65400 a CVSS base score of 7.1. Following the NCSC-NL disclosure and confirmation of exploitation across multiple targets, CISA intervened on 14 August 2026 to rescore the vulnerability to 9.8 Critical — a two-point jump reflecting the network-accessible, no-credential-required attack vector. On 18 August 2026, CISA formally added CVE-2026-65400 to the Known Exploited Vulnerabilities (KEV) catalogue, mandating remediation by 21 August for all US federal civilian agencies.

While the KEV deadline is binding only on federal agencies, the real-world signal is clear: exploitation is happening at scale, the flaw is trivially weaponisable, and the patch has been available for nearly three weeks as of this writing. Any organisation still running an unpatched, internet-exposed Screen Sharing host is operating a documented, publicly-known root-access backdoor.

Why Indian Enterprises Face Elevated Risk

Apple Silicon adoption in Indian IT, design, media production, and financial services has accelerated sharply since 2023. Many Indian enterprises now operate mixed Windows-macOS fleets — often without macOS-specific endpoint detection or MDM policies that enforce OS-level patch compliance. Screen Sharing is routinely enabled for internal IT helpdesk workflows and remote work arrangements, and in environments without rigorous network segmentation, TCP/5900 may be inadvertently reachable from beyond its intended scope.

The risk compounds significantly for Indian software firms and managed service providers running cloud-hosted Mac infrastructure for iOS/macOS CI/CD pipelines. These machines commonly have Screen Sharing enabled for administrative access, and port-5900 exposure is widespread. A compromised build server is not merely a crypto-miner — it is a launchpad into your software supply chain, a threat vector explored in depth after the RUSTSEC-2026-0260 Rust crate supply-chain attack earlier this month.

This vulnerability also reinforces a broader architectural lesson: trusting OS-level authentication as a network perimeter is not a security strategy. As seen with APT29’s WhatsApp MFA bypass and now this Screen Sharing flaw, when the authentication mechanism itself is the vulnerability, strong passwords and MFA tokens offer no protection. Only network-level zero-trust segmentation — where no endpoint is inherently trusted based on its location — provides resilient defence.

What You Should Do Right Now

Sanjay Seth’s recommended response, structured for Indian IT and security teams managing multi-platform environments:

Action	Priority	Detail
Patch all macOS endpoints	Critical	Update to Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9. MDM-push the update to all managed Apple endpoints within 24 hours.
Disable Screen Sharing if unused	Critical	System Settings → General → Sharing → Screen Sharing (toggle OFF). If required, restrict to named users and local network only.
Block TCP/5900 at perimeter	High	Firewall rules must deny inbound 5900 from all untrusted networks. Verify FortiGate or perimeter policies explicitly block this port.
Require VPN for remote Screen Sharing	High	Mandate VPN authentication before any Screen Sharing session. Never expose port 5900 directly to the internet — tunnel it.
Hunt for compromise indicators	High	Check: ~/.config/sysmond binary; com.apple.airportd plist in /Library/LaunchDaemons/; unauthorised keys in ~/.ssh/authorized_keys; anomalous screensharingd child processes.
Audit cloud Mac instances	High	Any cloud-hosted Mac used for CI/CD must be urgently audited. Verify provider-level firewall rules — OS-level settings alone are insufficient.
Instrument EDR for Screen Sharing events	Medium	Alert on ES_EVENT_TYPE_NOTIFY_SCREENSHARING_ATTACH events with session_username: root and authentication_type: SRP without RSA encryption.
Apply zero-trust micro-segmentation	Medium	macOS endpoints must never reach critical infrastructure directly. Micro-segmentation ensures a compromised Mac cannot pivot laterally to servers or cloud workloads.

Detection Signatures for Your Security Stack

Add the following indicators to your EDR and SIEM detection rules:

• Endpoint Security event: ES_EVENT_TYPE_NOTIFY_SCREENSHARING_ATTACH with session_username: root
• Process creation: SSFileCopySender launched with arguments 0 80
• File creation: ~/.config/sysmond executable; any com.apple.airportd-named plist in /Library/LaunchDaemons/
• Outbound network: connections to known Monero pool endpoints (e.g., pool.supportxmr.com:3333, xmrpool.eu:9999)
• Log integrity: truncated or cleared /var/log/system.log correlated with a preceding Screen Sharing session event

Frequently Asked Questions

Am I vulnerable if Screen Sharing is enabled but not exposed to the internet?

Your risk is significantly reduced if TCP/5900 is not accessible from untrusted networks. However, lateral-movement scenarios remain relevant — an attacker who gains initial access to your internal network via another vector (phishing, VPN compromise) can exploit CVE-2026-65400 to escalate to root on any internal Mac with Screen Sharing enabled. Patching remains mandatory; firewall rules provide defence-in-depth, not a substitute for the patch.

Does this affect Apple Silicon (M-series) as well as Intel Macs?

Yes. CVE-2026-65400 resides in the screensharingd daemon, which is architecture-independent. Both Apple Silicon (M1 through M4) and Intel-based Macs running affected macOS versions are equally vulnerable. The exploit does not rely on any processor-specific behaviour.

Is this related to generic VNC vulnerabilities?

No. While macOS Screen Sharing uses the RFB protocol (which VNC also uses), CVE-2026-65400 is a distinct flaw in Apple’s own SRP authentication implementation within screensharingd — not a generic VNC bug. Third-party VNC servers such as RealVNC are unaffected by this specific CVE.

What if we cannot patch immediately — are there effective workarounds?

The most effective interim mitigations are: (1) disable Screen Sharing entirely via System Settings → General → Sharing; and (2) block inbound TCP/5900 at your perimeter and host-based firewall. If Screen Sharing is operationally essential, restrict it to a dedicated management VLAN and mandate VPN authentication before any session. These are workarounds, not fixes — apply the Apple security update at the earliest possible opportunity.

CVE-2026-65400 is a blunt reminder that convenience features become attack surfaces the moment they face an untrusted network. Apple’s Screen Sharing has been a trusted IT tool for years — one wrong return value in a state machine has turned it into an unauthenticated root-access gateway. The patch has existed since 6 August; active exploitation was confirmed on 12 August; CISA flagged it as Critical on 14 August. Every day without the patch is a day this door stays open.

If your organisation operates macOS endpoints and you are uncertain about your exposure, attack surface, or zero-trust network readiness, contact Sanjay Seth for a security assessment. Whether auditing your Apple fleet, reviewing FortiGate firewall policies, or designing a zero-trust architecture that treats every endpoint as untrusted — the team helps Delhi NCR businesses and enterprises across India close these gaps before attackers find them.