CVE-2026-65400 is an authentication flaw in macOS Screen Sharing that can let a network attacker authenticate without valid credentials. Apple fixed it on August 6, 2026, and the Netherlands’ National Cyber Security Centre later reported public proof-of-concept code and active exploitation against Macs exposing TCP port 5900 to the internet.
This is a patch-and-hunt event. Installing the update is essential, but systems that were publicly reachable before the fix also require investigation.
Affected and fixed versions
Apple addressed CVE-2026-65400 with improved authentication state management in:
- macOS Tahoe 26.6.1
- macOS Sequoia 15.7.9
- macOS Sonoma 14.8.9
Administrators should compare the running OS version with the fixed releases. Do not treat a downloaded update or a pending restart as completion.
Why the exposure is urgent
NCSC-NL says it received reports of exploitation on multiple systems where port 5900 was reachable from the internet. In every reported case, the attacker obtained root access and installed a Monero cryptocurrency miner. The agency’s August 12 revision also notes that public proof-of-concept code is available.
That combination changes the response. A vulnerable service, reachable from an untrusted network, with public exploit material and confirmed compromise should be handled before routine patch queues.
Immediate response
- Find enabled services. Inventory Macs with Screen Sharing or Remote Management enabled. Include unmanaged lab machines, build systems, shared workstations, and devices outside the normal MDM scope.
- Check reachability. Confirm whether TCP 5900 is exposed directly, forwarded through a router, or reachable through a cloud security group. Review both IPv4 and IPv6 paths.
- Patch. Deploy the applicable Apple update and confirm the running version after restart.
- Remove unnecessary exposure. Disable Screen Sharing when it is not required. Where remote access is necessary, place it behind an approved VPN or zero-trust access layer and restrict source networks.
- Preserve evidence. On exposed systems, collect logs and current process, persistence, and network state before cleaning up suspicious activity.
What to investigate
The reported payload was a Monero miner, but defenders should not restrict hunting to a single filename or cryptocurrency wallet. Root access can support other persistence and credential theft.
- Unexpected Screen Sharing connections and authentication events.
- Processes consuming sustained CPU or GPU resources.
- New launch agents, launch daemons, login items, or scheduled jobs.
- Unsigned or recently created executables in user-writable and temporary directories.
- Outbound connections to mining pools, unfamiliar VPS providers, or newly observed domains.
- New local users, changed SSH settings, added remote-management permissions, or modified firewall rules.
- Security tooling disabled or excluded from monitoring.
If compromise is suspected, isolate the host while preserving access to evidence. Rotate credentials used on the Mac only after the system is contained, and consider tokens and sessions as well as passwords.
Network controls that matter
Blocking public port 5900 is the fastest compensating control, but it is not the entire architecture. Review router port forwarding, host firewalls, cloud ingress rules, remote-support tooling, and any tunnels that can expose the service indirectly. A scanner that checks only the corporate public IP range may miss laptops connected through home routers or temporary cloud hosts.
Use centralized policy to prevent users from silently enabling remote access. Alert when Screen Sharing becomes active on devices that are not approved remote-management endpoints.
Verification checklist
| Question | Evidence |
|---|---|
| Is the fixed release running? | OS version from the endpoint after restart |
| Was port 5900 exposed? | Firewall, router, cloud, and external-scan records |
| Could exploitation predate patching? | First patch time compared with exposure and log history |
| Was root persistence created? | Launch items, accounts, services, binaries, configuration changes |
| Is the service still required? | Documented owner and approved remote-access use case |
Practical takeaway
Patch CVE-2026-65400 immediately, but do not stop at version compliance. Any Mac that exposed Screen Sharing to the internet before the update should be treated as potentially compromised until logs, persistence, processes, and outbound traffic have been reviewed.
Sources
- Apple: macOS Tahoe 26.6.1 security content
- Apple: macOS Sequoia 15.7.9 security content
- Apple: macOS Sonoma 14.8.9 security content
- NCSC-NL advisory NCSC-2026-0280
