macOS Screen Sharing Flaw CVE-2026-65400 Actively Exploited for Cryptomining

Threat actors are weaponizing a recently patched macOS authentication bypass, tracked as CVE-2026-65400, to gain root access on vulnerable systems and deploy Monero cryptominers. Apple disclosed and addressed the high-severity flaw in Screen Sharing on August 6, shipping fixes across macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9. The bug resides in screensharingd, the daemon that manages Screen Sharing connections, and allows remote attackers to authenticate without valid credentials.

According to security firm Calif, exploitation is alarmingly trivial: an attacker only needs to know a valid username on the target machine. "A username is not a secret, and macOS prints them on the login window," the firm noted. The flaw permits a remote actor to authenticate to any macOS host with Screen Sharing enabled simply by supplying an account name. Apple has since improved state management mechanisms to enforce proper credential validation and block unauthorized logins. The Dutch National Cyber Security Centrum (NCSC) confirmed it has observed active abuse on multiple systems with port 5900 exposed to the internet, and administrators can audit their own exposure using a port scanner to verify whether Screen Sharing is reachable externally.

Researcher osxrev3rse warned on August 8 that approximately 40,000 internet-accessible macOS instances had Screen Sharing enabled at the time of disclosure, placing them squarely in the crosshairs of opportunistic miners. The NCSC's notification corroborates that attackers have chained the authentication flaw with cryptominer payloads, planting Monero miners on compromised hosts. Beyond credential hygiene, defenders should run a password checker and WHOIS lookup on any suspicious source IPs observed in Screen Sharing logs to enrich threat intelligence.

CVE-2026-65400 is not an isolated incident. In late July, Apple quietly patched four additional screensharingd defects, including three assigned CVE identifiers, and reportedly fixed a fourth, more severe unauthenticated remote code execution flaw that required only knowledge of the target's IP address and a disabled System Integrity Protection (SIP). That issue enabled attackers to drop a reverse shell and a root crontab over the same Screen Sharing connection with zero user interaction. Organizations running macOS in production should prioritize updating to the latest patched builds, disable Screen Sharing where it is not strictly required, and block inbound port 5900 traffic at the network perimeter.