> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # CVE-2026-65400 — Apple macOS: Apple macOS Improper Authentication Vulnerability - URL: https://f4n6.co.uk/security-feed/cve-2026-65400-apple-macos-apple-macos-improper-authentication-vulnerability/ - Published: 2026-08-18T23:10:22.000Z - Updated: 2026-08-18T23:10:22.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-65400 ## 1\. Executive summary CVE-2026-65400 is a critical (CVSS 9.8) improper authentication vulnerability (CWE-287) in Apple macOS Screen Sharing that allows a network-adjacent attacker to authenticate to the service without valid credentials. The flaw is actively exploited in the wild and was added to the CISA KEV catalogue on 2026-08-18\. Dutch NCSC has reported incidents where exploitation led to root-level access and deployment of Monero cryptominers. EMEA financial services running macOS endpoints with Screen Sharing enabled — particularly those with port 5900 exposed to the internet or internal networks — face immediate risk of remote compromise, persistence, and lateral movement. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 24: digital operational resilience testing — general requirements | Active exploitation of a CVSS 9.8 KEV-listed vulnerability on macOS endpoints with Screen Sharing enabled requires immediate validation that patching and exposure controls are effective. | Clients must verify that macOS endpoints are patched to the fixed versions or that Screen Sharing is disabled, and document this as part of operational resilience testing. | | DORA Art. 19: reporting of major ICT-related incidents to competent authorities | Confirmed in-the-wild exploitation resulting in root-level compromise and cryptominer installation on macOS endpoints constitutes a major ICT-related incident if impact thresholds are met. | Clients with confirmed exploitation must assess whether the incident meets major-incident classification criteria and report to competent authorities within applicable timelines. | | NIS2 Art. 23: incident reporting obligations | Active exploitation leading to root compromise of systems potentially within essential/important entity scope triggers incident notification obligations. | NIS2-scoped organisations must evaluate whether this exploitation constitutes a significant incident requiring early warning and notification to CSIRTs/competent authorities. | ## 3\. Technical analysis & attack chain **Vulnerability mechanism:** CVE-2026-65400 is an improper authentication flaw in macOS Screen Sharing (CWE-287). Apple's fix was implemented through "improved state management," indicating an authentication-flow or session-state validation failure rather than a cryptographic break. The CVSS 3.1 vector is `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` — network-adjacent, low complexity, no privileges required, no user interaction, with full confidentiality, integrity, and availability impact. ### Confirmed attack chain 1. **Reconnaissance:** Attacker identifies macOS hosts with Screen Sharing enabled on port 5900 (VNC). Highest exposure is on hosts where port 5900 is internet-accessible via router port-forward, public IP, or hosting-provider setup. Internal-only hosts are also exposed if the attacker has a position on the network. 2. **Authentication bypass:** Attacker connects to the Screen Sharing service on port 5900 and authenticates without valid credentials by exploiting the session-state validation failure. 3. **Remote control:** Successful exploitation grants the attacker full Screen Sharing functionality — viewing and controlling the Mac remotely. 4. **Privilege escalation to root:** In confirmed incidents reported by Dutch NCSC, attackers escalated from the Screen Sharing session to root access. The specific privilege-escalation mechanism is not detailed in the source material. 5. **Payload deployment:** Attackers installed Monero cryptomining software. Monero was likely chosen because it is CPU/GPU-mineable without ASICs, making compromised general-purpose macOS hosts viable mining targets. 6. **Post-exploitation potential:** With root-level access, attackers could enable persistence, conduct data theft, harvest credentials and keys, deploy additional malware, and perform lateral movement. The source notes that cryptomining is not necessarily the worst-case outcome. ### Affected and fixed versions - Fixed in: macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9 - Patch released by Apple on 2026-08-06. **Additional context:** Huntress reports that the same macOS update addressed a second Screen Sharing vulnerability (CVE-2026-43760) enabling pre-authenticated remote code execution. BSI Germany (WID-SEC-2025-2475) separately flagged multiple macOS vulnerabilities including information disclosure, denial of service, security bypass, file manipulation, and privilege escalation. These additional CVEs are contextual and not the subject of this advisory. **Confidence caveat:** The exploitation details (root access, Monero cryptominer deployment) are single-sourced to the Dutch NCSC warning as reported by Malwarebytes Labs. The specific privilege-escalation step from Screen Sharing session to root is not documented in the source material. Attribution to any named threat actor is not present in the sources; no MITRE ATT&CK actor profile is available. Treat the cryptominer deployment as confirmed (NCSC-reported incidents) but the intermediate technical steps as unconfirmed. ## 4\. Mitigation & containment ### P1 — Within 24 hours 1. **Patch all macOS endpoints** to the fixed versions: - macOS Tahoe → 26.6.1 - macOS Sequoia → 15.7.9 - macOS Sonoma → 14.8.9 - Apply via Software Update (`System Settings → General → Software Update`) or MDM/patch management tooling. 2. **Disable Screen Sharing immediately** on all macOS endpoints where it is not explicitly required: - `System Settings → General → Sharing → Screen Sharing → Off` \- Also disable Remote Management on the same Sharing pane if not in active use. - Via command line: `sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.screensharing.plist` 3. **Block port 5900** at network perimeter firewalls for all inbound traffic to macOS endpoints. Verify no port-forwarding rules on edge routers expose VNC/Screen Sharing to the internet. 4. **Hunt for compromise** on any macOS host known to have had Screen Sharing enabled and reachable on port 5900 prior to patching: - Check for unexpected CPU-intensive processes (potential cryptominer activity). - Review `/Library/LaunchDaemons/`, `/Library/LaunchAgents/`, `~/Library/LaunchAgents/` for suspicious persistence entries. - Check for unauthorised SSH keys in `~/.ssh/authorized_keys`. - Review `sudo` logs and `/var/log/` for unexpected privilege escalation. ### P2 — Within 72 hours 1. **Validate patch deployment** across the full macOS estate using MDM inventory or endpoint visibility tooling. Confirm no endpoints remain on vulnerable versions. 2. **Audit Screen Sharing and Remote Management configuration** enterprise-wide. Enforce a configuration profile via MDM that disables Screen Sharing unless an explicit exception is approved. 3. **Review network segmentation** to ensure macOS endpoints are not reachable from untrusted network segments on port 5900, even internally. ### P3 — Within 7 days 1. **Conduct retrospective forensic review** of any macOS host that was exposed and cannot be confirmed clean. Given root-level compromise was observed, assume full system integrity may be compromised — rebuild from known-good media if compromise is suspected. 2. **Update EDR/endpoint security policies** to alert on Screen Sharing service activation and unexpected VNC connections on port 5900. 3. **Document the incident response** and patching activity for DORA Art. 24 operational resilience testing records. ## 5\. Indicators of compromise No atomic indicators of compromise (hashes, domains, IPs, file names) are available in the source material. The sources describe observed behaviours but no specific IOCs from the confirmed incidents. ### Behavioural indicators | Behaviour | Where to observe | Confidence | | --------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- | | Sustained high CPU utilisation by unknown process | Activity Monitor, EDR process monitoring, MDM telemetry | High — NCSC-confirmed cryptominer deployment | | Screen Sharing service enabled on port 5900 without documented business justification | macOS Sharing settings, MDM configuration profiles, network port scans | High — prerequisite for exploitation | | Unexpected VNC connection to port 5900 from non-corporate IP | Network firewall logs, EDR network telemetry, SIEM | Medium — consistent with attack vector but not independently confirmed | | New or modified LaunchDaemon/LaunchAgent entries created outside normal IT provisioning | EDR file integrity monitoring, MDM compliance checks | Medium — expected persistence mechanism post-root-compromise but not directly observed in sources | ## 6\. Detection Insufficient indicators to author detection rules. The source material does not contain specific file names, command-line strings, mutex names, registry keys, or other artefacts attributable to the threat itself. The behavioural indicators in §5 should be implemented as custom SIEM/EDR correlation rules based on the described patterns. ## CVE assessment 1 referenced CVE — **1 actively exploited (CISA KEV)**, 1 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ------------ | ---------------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-65400](https://nvd.nist.gov/vuln/detail/CVE-2026-65400?ref=f4n6.co.uk) | 9.8 Critical | ⚠ KEV 2026-08-18 | 0% | An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma… | ## 7\. Sources - NVD, "CVE-2026-65400 Detail," https://nvd.nist.gov/vuln/detail/CVE-2026-65400, accessed 2026-08-18 - Malwarebytes Labs, "Update your Mac: Screen Sharing vulnerability exploited in the wild," https://www.malwarebytes.com/blog/bugs/2026/08/update-your-mac-screen-sharing-vulnerability-exploited-in-the-wild, 2026-08 - Huntress, "From Screen Share to Root Access: Breaking Down CVE-2026-43760 and CVE-2026-65400 on macOS," https://www.huntress.com/blog/macos-screen-sharing-rce-patched, 2026-08 - BSI Germany, "\[UPDATE\] \[kritisch\] Apple macOS: Mehrere Schwachstellen," https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-2475, 2026-08 - Dutch NCSC advisory referenced via NVD: https://advisories.ncsc.nl/2026/ncsc-2026-0280.html ## 8\. Adverse Trace position CVE-2026-65400 is a CVSS 9.8 CRITICAL vulnerability with confirmed active exploitation (CISA KEV, added 2026-08-18) leading to root-level compromise and cryptominer deployment. The attack surface is specific and identifiable — macOS hosts with Screen Sharing enabled on port 5900 — and a vendor patch has been available since 2026-08-06\. EMEA financial services clients should treat this as an immediate P1: patch all macOS endpoints to Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9, disable Screen Sharing where not required, and hunt for signs of compromise on previously exposed hosts. The exploitation details are single-sourced to Dutch NCSC reporting; we will update this advisory if additional technical details, IOCs, or attribution information emerge. No named threat actor has been identified in the available sources; attribution is unconfirmed. --- [Read the original source →](https://nvd.nist.gov/vuln/detail/CVE-2026-65400?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*