macOS Screen Sharing Flaw Gets Critical Rating After Root Compromises
CVE-2026-65400 in macOS Screen Sharing was raised to a 9.8 critical score after Dutch officials documented exposed Macs being rooted and used for Monero mining.
A macOS Screen Sharing flaw moved into critical territory after Dutch officials documented active compromises of internet-exposed Macs, Tom's Hardware reported, turning a remote-access bug into an urgent patching issue for organizations that leave VNC reachable online.
The vulnerability, CVE-2026-65400, is an authentication bypass in Screen Sharing.
Apple patched it on August 6 in out-of-band updates for macOS Tahoe 26.6.1, Sequoia 15.7.9 and Sonoma 14.8.9, but the risk rating changed after the patch as exploitation evidence accumulated.
The NCSC-NL timeline starts with an August 7 advisory urging immediate updates.
A revised August 12 advisory put public proof-of-concept code and multiple abused exposed systems into the record.
The compromise pattern is severe for defenders because attackers gained root access in every incident reported to the Dutch agency and installed a Monero cryptocurrency miner.
Systems with TCP port 5900 exposed are the clearest risk group because Screen Sharing uses the VNC-based remote desktop service on that port.
CISA changed the National Vulnerability Database scoring on August 14, raising the CVSS rating from 7.1 to 9.8.
The new vector assumes no privileges are needed and full compromise of confidentiality, integrity and availability is possible, replacing an earlier assessment that treated the bug as lower impact and privilege-dependent.
A later CISA decision record also switched the flaw from not automatable to automatable.
That shift fits the cryptomining pattern because unattended remote-access services can be scanned and exploited repeatedly when a working exploit becomes public.
Technical details appeared at Black Hat last week, where the exploit was demonstrated in action.
The access level described in the Dutch incidents matches the root-level control shown by researchers, while the mining activity has no identified single threat actor in the available record.
Apple's advisory describes a network attacker reaching Screen Sharing without valid credentials, with improved authentication state management as the fix.
Apple leaves Screen Sharing disabled by default; exposed enterprise or lab machines remain in the risk group when remote desktop access is enabled and firewall rules allow port 5900.
The flaw has not yet appeared in CISA's Known Exploited Vulnerabilities catalog, and one CISA record still lists exploitation as none despite the Dutch advisory.
That mismatch leaves patch management teams with two separate signals: a critical automated-exploitation score from CISA and observed compromise evidence from NCSC-NL.
The August 6 update also makes Screen Sharing a repeated patch area for Apple.
A late-July security round fixed CVE-2026-43760, a separate Screen Sharing issue that required valid credentials, while the newer bypass covers only one CVE and prompted an out-of-band release.
Mac administrators that cannot update immediately can disable Screen Sharing under System Settings, General, Sharing.
The safest remediation remains applying Apple's August 6 update, because the service-level workaround only helps machines where remote desktop access can be turned off without interrupting operations.
For inventory teams, the exposure check is narrower than a full macOS fleet audit: find Macs with Screen Sharing enabled, verify whether port 5900 is reachable from untrusted networks, and prioritize systems that cannot move quickly to Tahoe 26.6.1, Sequoia 15.7.9 or Sonoma 14.8.9.
