A recently patched security flaw in Apple macOS has come under active exploitation in the wild to deploy a cryptocurrency miner, the Netherlands National Cyber Security Centre (NCSC) has warned.
The vulnerability in question is CVE-2026-65400 (CVSS score: 9.8), a critical authentication issue impacting the Screen Sharing component that could allow an attacker already on the network to authenticate to the built-in remote desktop feature service without valid credentials.
The updates released by Apple improve state management mechanisms to enforce correct credential validation and prevent unauthorized authentication attempts. The shortcoming was addressed as part of an emergency update in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9 earlier this month.
"An authentication issue was addressed with improved state management," Apple said in an advisory released on August 6, 2026. It credited security researcher Alfredo Pesoli of Bynario for discovering and reporting the issue.
In an update to its advisory, the NCSC-NL said it has received a report indicating active abuse of the vulnerability across multiple systems on which port 5900 was accessible from the internet.
"In all these cases, root had gained access to the affected system and placed a Monero crypto miner," the agency added.
There are currently no details on when these attacks were observed, the scale of such efforts, if the flaw was exploited as a zero-day, and if it goes beyond cryptocurrency mining.
Calif, which published additional information about the flaw, said it's part of a series of bugs in the Screen Sharing Server component that were patched by Apple with macOS Tahoe 26.6 shipped late last month -
- CVE-2026-43779 (CVSS score: 9.8) - A logic issue that could allow an app to intercept network connections intended for another process
- CVE-2026-43777 (CVSS score: 7.5) - An unspecified issue that could a remote attacker to cause a denial-of-service (DoS)
- CVE-2026-43760 (CVSS score: 8.6) - An access issue that could allow an app to access user-sensitive data
In a post published following the release of the patches, Pesoli described CVE-2026-43760 as a post authentication bug that requires the target Mac to have Screen Sharing or Remote Management enabled with "VNC viewers may control screen with password" configured and the attacker is already in possession of that VNC password.
The problem, the researcher noted, resides in a legacy Screen Sharing authentication path involving VNC password access that turns a file copy operation into protected file disclosure, arbitrary root file creation, and remote root command execution.
"After the VNC authentication step, we cross a boundary the password was never supposed to cross," Pesoli explained. "A remote viewer can make macOS Screen Sharing read protected files as root."
"In the other direction, the viewer can create attacker-controlled files as root. We used that second primitive to install a valid sudoers policy and turn a file-copy operation into a remote root command execution (or an LPE)."
However, a security researcher who goes by the online alias @osxreverser said the real issue is a pre-authentication vulnerability in the Screen Sharing daemon ("screensharingd") that makes it possible to pwn any Mac that has Screen Sharing enabled without having to know the password or anything else. The only prerequisite is knowing the IP address.
The researcher also noted that they had been sitting on the bug "for a while" and that they did not report the issue to Apple "given my long history with them."
"My last scan shown around 40k open screen sharing hosts on the internet, almost half in the U.S., most are residential IPs but there are many juicy hosts in Murican universities, some companies, a server from BBEdit company," @osxreverser said in a subsequent post on X. "Party hard, never expose those services unless behind SSH."
It's worth noting that CVE-2026-65400 is distinct from the pre-auth vulnerability highlighted by @osxreverser, the latter of which was fixed by the tech giant in macOS 26.6 itself along with the other three flaws. What's interesting here is that both of them reside in the same source code file, per Calif -
@osxreverser's bug is a single wrong return. A length check bails out early on an oversized frame and hands back a value that happens to be the success code from the read just before it. The caller reads that as "this auth step passed" and advances the state machine. Where the first bug is a stale return value, the second is a state machine desync.
Naming an account is the one thing the second bug needs, which makes it weaker than the first. It is not much of a barrier. A username is not a secret, and macOS prints them on the login window. The first bug does not even need that. The second bug was present in 26.5.2 too, sitting next to the first one the whole time.
Both are logic bugs. There is no heap groom, no ASLR defeat, no race to win, no crash. Send one or two packets in the right order, and the target Mac machine lets you in. It works the first time, and it works every time, on every unpatched machine with Screen Sharing enabled.
Calif said it's withholding additional specifics about CVE-2026-65400 until a majority of users are upgraded with a fix, given the ease with which the two pre-auth remote root exploits can be devised using an artificial intelligence (AI) agent. The AI security company revealed it came up with a working exploit for both flaws in four hours.
With CVE-2026-65400 now under active attack, the findings once again demonstrate how AI is collapsing the gap between vulnerability discovery and weaponization.
Users are recommended to update their systems to the latest version for optimal protection. If immediate patching of the flaw is not possible, it's advised to turn off Screen Sharing by navigating to General > Sharing > Toggle Screen Sharing from "Content & Media."
