--- title: Hackers exploit macOS Screen Sharing flaw to deploy... description: The Netherlands' National Cyber Security Centre warns that a macOS Screen Sharing authentication bypass vulnerability, CVE-2026-65400, is being actively... canonical: https://daily.dev/posts/hackers-exploit-macos-screen-sharing-flaw-to-deploy-monero-miner-7oxvaaavl twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Hackers exploit macOS Screen Sharing flaw to deploy Monero miner | daily.dev og:description: The Netherlands' National Cyber Security Centre warns that a macOS Screen Sharing authentication bypass vulnerability, CVE-2026-65400, is being actively... og:url: https://daily.dev/posts/hackers-exploit-macos-screen-sharing-flaw-to-deploy-monero-miner-7oxvaaavl og:image: https://api.daily.dev/og/posts/7OXvaAavL.png og:image:alt: Hackers exploit macOS Screen Sharing flaw to deploy Monero miner og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Hackers exploit macOS Screen Sharing flaw to deploy Monero miner **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 2 min read · 0 upvotes · 0 comments ## Summary The Netherlands' National Cyber Security Centre warns that a macOS Screen Sharing authentication bypass vulnerability, CVE-2026-65400, is being actively exploited in the wild after public exploit code emerged. Attackers exposing port 5900 to the internet gained root access without valid credentials and deployed Monero cryptocurrency miners. Apple patched the flaw on August 6 in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. Users who cannot update immediately are advised to disable Screen Sharing via System Settings. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-65400 and is it being actively exploited? CVE-2026-65400 is a macOS Screen Sharing authentication bypass vulnerability that lets network-based attackers gain access without valid credentials over VNC port 5900. The Netherlands' National Cyber Security Centre confirmed active exploitation in the wild, with attackers gaining root access on exposed systems and installing Monero cryptocurrency miners. _daily.dev keeps security teams current on actively exploited macOS vulnerabilities like this one._ ### Which macOS versions fix the Screen Sharing authentication bypass vulnerability? Apple fixed CVE-2026-65400 on August 6 with macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9. These updates improve state management mechanisms to enforce correct credential validation and prevent rogue authentication attempts against Screen Sharing over port 5900. _Track critical macOS patch versions like these on daily.dev before rolling out updates._ ### How can I protect my Mac if I can't immediately patch the Screen Sharing vulnerability? If a system update isn't immediately possible, disable Screen Sharing through System Settings under General, then Sharing, then toggling off Screen Sharing. This closes the exposed VNC port 5900 that attackers use to remotely bypass authentication and gain root access for deploying cryptocurrency miners. _Developers securing macOS fleets follow mitigation steps like this on daily.dev._ ## Similar posts on daily.dev - [Attackers build “silent” cryptominer on victim’s machine and give themselves away](https://daily.dev/posts/attackers-build-silent-cryptominer-on-victim-s-machine-and-give-themselves-away-ub0cbxgd9) · IT Security Guru · 1 upvotes · 0 comments - [I got hacked, my server started mining Monero this morning.](https://daily.dev/posts/i-got-hacked-my-server-started-mining-monero-this-morning--2rfojzh4u) · Hacker News · 2 upvotes · 1 comments - [New CrashStealer malware poses as Apple crash reporting tool](https://daily.dev/posts/new-crashstealer-malware-poses-as-apple-crash-reporting-tool-olhhkemin) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#mac](https://daily.dev/tags/mac) [View this post on daily.dev](https://daily.dev/posts/hackers-exploit-macos-screen-sharing-flaw-to-deploy-monero-miner-7oxvaaavl) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Hackers exploit macOS Screen Sharing flaw to deploy Monero miner","url":"https://daily.dev/posts/hackers-exploit-macos-screen-sharing-flaw-to-deploy-monero-miner-7oxvaaavl","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hackers-exploit-macos-screen-sharing-flaw-to-deploy-monero-miner-7oxvaaavl"},"datePublished":"2026-08-14T15:04:08.510Z","dateModified":"2026-08-21T15:51:18.135Z","description":"The Netherlands' National Cyber Security Centre warns that a macOS Screen Sharing authentication bypass vulnerability, CVE-2026-65400, is being actively...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c6cf731ef92f414e0eb0ad90e53126bc?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c6cf731ef92f414e0eb0ad90e53126bc?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/hackers-exploit-macos-screen-sharing-flaw-to-deploy-monero-miner-7oxvaaavl","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,mac","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Hackers exploit macOS Screen Sharing flaw to deploy Monero miner"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/hackers-exploit-macos-screen-sharing-flaw-to-deploy-monero-miner-7oxvaaavl#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-65400 and is it being actively exploited?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-65400 is a macOS Screen Sharing authentication bypass vulnerability that lets network-based attackers gain access without valid credentials over VNC port 5900. The Netherlands' National Cyber Security Centre confirmed active exploitation in the wild, with attackers gaining root access on exposed systems and installing Monero cryptocurrency miners. daily.dev keeps security teams current on actively exploited macOS vulnerabilities like this one."}},{"@type":"Question","name":"Which macOS versions fix the Screen Sharing authentication bypass vulnerability?","acceptedAnswer":{"@type":"Answer","text":"Apple fixed CVE-2026-65400 on August 6 with macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9. These updates improve state management mechanisms to enforce correct credential validation and prevent rogue authentication attempts against Screen Sharing over port 5900. Track critical macOS patch versions like these on daily.dev before rolling out updates."}},{"@type":"Question","name":"How can I protect my Mac if I can't immediately patch the Screen Sharing vulnerability?","acceptedAnswer":{"@type":"Answer","text":"If a system update isn't immediately possible, disable Screen Sharing through System Settings under General, then Sharing, then toggling off Screen Sharing. This closes the exposed VNC port 5900 that attackers use to remotely bypass authentication and gain root access for deploying cryptocurrency miners. Developers securing macOS fleets follow mitigation steps like this on daily.dev."}}]} ```