--- title: macOS Screen Sharing bug (CVE-2026-65400) exploited in... description: A critical macOS Screen Sharing vulnerability (CVE-2026-65400) allowing attackers to bypass authentication and gain root access is being actively exploited in... canonical: https://daily.dev/posts/macos-screen-sharing-bug-cve-2026-65400-exploited-in-the-wild-for-root-access-wkq4o44se twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: macOS Screen Sharing bug (CVE-2026-65400) exploited in the wild for root access | daily.dev og:description: A critical macOS Screen Sharing vulnerability (CVE-2026-65400) allowing attackers to bypass authentication and gain root access is being actively exploited in... og:url: https://daily.dev/posts/macos-screen-sharing-bug-cve-2026-65400-exploited-in-the-wild-for-root-access-wkq4o44se og:image: https://api.daily.dev/og/posts/WKQ4O44sE.png og:image:alt: macOS Screen Sharing bug (CVE-2026-65400) exploited in the wild for root access og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # macOS Screen Sharing bug (CVE-2026-65400) exploited in the wild for root access **[Collections](https://daily.dev/sources/collections)** · 2 min read · 0 upvotes · 0 comments ## Summary A critical macOS Screen Sharing vulnerability (CVE-2026-65400) allowing attackers to bypass authentication and gain root access is being actively exploited in the wild, according to the Netherlands' NCSC. Attackers scan for Macs with port 5900 exposed to the internet, bypass the credential check due to a state management flaw, gain root, and deploy Monero cryptominers. Apple rated the bug 7.1/10 and patched it on August 6 in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. Exploitation began shortly after details were disclosed at Black Hat. Users should update immediately or disable Screen Sharing if they cannot patch right away. ## Content ## What happened Two bugs in macOS's `screensharingd` — the daemon behind Screen Sharing — let attackers get root access on a Mac without a username or password. Both have been exploited in the wild to install Monero miners, and Apple has already shipped fixes. Here's the full picture, pulled together from the technical writeups, the vendor advisories, and the Dutch government's incident reports. ## The two bugs **CVE-2026-43760** is a straightforward logic error. A function that checks the size of an authentication frame returns the wrong variable when the check fails. That means an oversized frame — one that should be rejected — gets misread as authentication success (a return value of 0 gets mistaken for "OK"). Send one crafted TCP packet, and you're in: arbitrary root file read/write, and from there, full remote code execution. It works even with legacy VNC turned off and no local accounts configured on the machine. Dig into the root cause and it's actually an SRP (Secure Remote Password) authentication error — a stale success status gets returned, and the session just... continues, in cleartext, as if nothing went wrong. **CVE-2026-65400** is stranger. It's a state machine desync. Send an auth attempt using a fake user with auth type 36. Then retry with no auth type at all, this time against a real user. The two requests corrupt the daemon's internal state tracking, and the second attempt gets waved through as authenticated. Neither of these is a memory-safety bug. I want to underline that because it matters for the ## Questions this post answers ### What is CVE-2026-65400 and how does it let attackers get root access on a Mac? CVE-2026-65400 is a macOS Screen Sharing vulnerability caused by a state management flaw that lets the authentication process be tricked into skipping the credential check entirely, granting root access without a password. Attackers exploit it by targeting Macs with port 5900 exposed to the internet, then drop Monero cryptominers on compromised machines. Apple rated it 7.1 out of 10 in severity. _Track actively exploited macOS vulnerabilities like this one on daily.dev to patch before attackers strike._ ### Which macOS versions fix CVE-2026-65400 and when was it patched? Apple fixed the Screen Sharing root access flaw on August 6 with updates to macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. The Netherlands' National Cyber Security Centre reported active exploitation shortly after details were disclosed at Black Hat, so machines running earlier versions remain vulnerable until updated. _Keep macOS patch timelines like this one handy on daily.dev when planning fleet updates._ ### How can I protect my Mac from the Screen Sharing root exploit if I can't update immediately? Disable Screen Sharing in System Settings until the update can be applied. Exposing port 5900, the standard VNC/Screen Sharing port, to the internet on an unpatched Mac allows attackers to bypass authentication entirely and gain root access, after which they commonly install Monero cryptominers. _daily.dev surfaces mitigation steps for active exploits like this one while patches roll out._ --- Tags: [#security](https://daily.dev/tags/security), [#apple](https://daily.dev/tags/apple), [#authentication](https://daily.dev/tags/authentication), [#mac](https://daily.dev/tags/mac) [View this post on daily.dev](https://daily.dev/posts/macos-screen-sharing-bug-cve-2026-65400-exploited-in-the-wild-for-root-access-wkq4o44se) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"macOS Screen Sharing bug (CVE-2026-65400) exploited in the wild for root access","url":"https://daily.dev/posts/macos-screen-sharing-bug-cve-2026-65400-exploited-in-the-wild-for-root-access-wkq4o44se","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/macos-screen-sharing-bug-cve-2026-65400-exploited-in-the-wild-for-root-access-wkq4o44se"},"datePublished":"2026-08-14T20:15:21.415Z","dateModified":"2026-08-21T15:51:18.165Z","description":"A critical macOS Screen Sharing vulnerability (CVE-2026-65400) allowing attackers to bypass authentication and gain root access is being actively exploited in...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/98487e8d4635263dce3c5bcf2cbb8f53?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/98487e8d4635263dce3c5bcf2cbb8f53?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/macos-screen-sharing-bug-cve-2026-65400-exploited-in-the-wild-for-root-access-wkq4o44se","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,apple,authentication,mac","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"macOS Screen Sharing bug (CVE-2026-65400) exploited in the wild for root access"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/macos-screen-sharing-bug-cve-2026-65400-exploited-in-the-wild-for-root-access-wkq4o44se#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-65400 and how does it let attackers get root access on a Mac?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-65400 is a macOS Screen Sharing vulnerability caused by a state management flaw that lets the authentication process be tricked into skipping the credential check entirely, granting root access without a password. Attackers exploit it by targeting Macs with port 5900 exposed to the internet, then drop Monero cryptominers on compromised machines. Apple rated it 7.1 out of 10 in severity. Track actively exploited macOS vulnerabilities like this one on daily.dev to patch before attackers strike."}},{"@type":"Question","name":"Which macOS versions fix CVE-2026-65400 and when was it patched?","acceptedAnswer":{"@type":"Answer","text":"Apple fixed the Screen Sharing root access flaw on August 6 with updates to macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. The Netherlands' National Cyber Security Centre reported active exploitation shortly after details were disclosed at Black Hat, so machines running earlier versions remain vulnerable until updated. Keep macOS patch timelines like this one handy on daily.dev when planning fleet updates."}},{"@type":"Question","name":"How can I protect my Mac from the Screen Sharing root exploit if I can't update immediately?","acceptedAnswer":{"@type":"Answer","text":"Disable Screen Sharing in System Settings until the update can be applied. Exposing port 5900, the standard VNC/Screen Sharing port, to the internet on an unpatched Mac allows attackers to bypass authentication entirely and gain root access, after which they commonly install Monero cryptominers. daily.dev surfaces mitigation steps for active exploits like this one while patches roll out."}}]} ```