> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# Update your Mac: Screen Sharing vulnerability exploited in the wild
- URL: https://f4n6.co.uk/security-feed/update-your-mac-screen-sharing-vulnerability-exploited-in-the-wild/
- Published: 2026-08-17T14:33:42.000Z
- Updated: 2026-08-17T14:33:42.000Z
- Author: Jeff Davies
- Tags: #security-feed, CVE-2026-65400

## 1\. Executive summary

CVE-2026-65400 is a **CVSS 9.8 CRITICAL** macOS Screen Sharing vulnerability classified as **CWE-287 (Improper Authentication)**; a network attacker may authenticate without valid credentials and remotely control an exposed Mac. Apple fixed the issue in macOS Tahoe 26.6.1, Sequoia 15.7.9 and Sonoma 14.8.9\. Malwarebytes reports several incidents involving root access and installation of Monero cryptominers, but this exploitation claim is single-sourced in the supplied material and should be verified before enforcement; CVE-2026-65400 is **not listed in CISA KEV** and has **EPSS 0%**. EMEA financial institutions should prioritise enabled, network-reachable Screen Sharing services—particularly port 5900 exposed through public addressing or port forwarding—and treat affected systems showing suspicious remote-control or mining activity as potentially fully compromised. No actor is named, so attribution is unavailable.

## 2\. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

## 3\. Technical analysis & attack chain

CVE-2026-65400 is **CVSS 9.8 CRITICAL**, **CWE-287 (Improper Authentication)**, **not listed in CISA KEV**, and has **EPSS 0%**. Its absence from CISA KEV is the authoritative catalogue state; the separate claim of active exploitation comes from a single supplied Malwarebytes report relaying information attributed to the Dutch NCSC.

### Confirmed technical chain

1. **Exposure prerequisite:** Screen Sharing must be enabled and reachable by the attacker. The service is commonly associated with port 5900\. Internet exposure can arise from router port forwarding, direct public addressing or hosting-provider configuration. An internally reachable service requires the attacker first to obtain a network position capable of reaching the Mac.
2. **Authentication bypass:** A network attacker exploits CVE-2026-65400 to authenticate to Screen Sharing without valid credentials. This behaviour is corroborated by the [GitHub Security Advisory](https://github.com/advisories/GHSA-cwph-f4w9-f4wq?ref=f4n6.co.uk).
3. **Remote control:** A successful connection provides the viewing and control capabilities inherent to Screen Sharing. The supplied material does not describe exploit requests, session fields, authentication messages or other wire-level details.
4. **Remediation mechanism:** Apple addressed the authentication issue through “improved state management.” Malwarebytes interprets this as an authentication-flow or session-state validation failure rather than a cryptographic failure; that mechanism is an inference, not a disclosed root-cause analysis.
5. **Fixed releases:** The issue is fixed in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9\. The supplied sources do not define complete vulnerable-version ranges.

### Reported exploitation and post-compromise activity

[Malwarebytes](https://www.malwarebytes.com/blog/bugs/2026/08/update-your-mac-screen-sharing-vulnerability-exploited-in-the-wild?ref=f4n6.co.uk) reports that the Dutch NCSC was notified of several incidents in which attackers obtained root access and installed Monero cryptomining software. The report does not explain whether root access resulted directly from Screen Sharing, a subsequent privilege-escalation step, pre-existing privileges or host configuration. It also provides no miner family, executable name, command line, hash, installation path or wallet address.

The reported payload consumed commodity CPU or GPU resources to mine Monero. No persistence mechanism, launch agent, launch daemon, scheduled task, service, command-and-control infrastructure, lateral-movement method or exfiltration channel is disclosed.

Malwarebytes identifies persistence, credential or key harvesting, data theft, further malware deployment and lateral movement as possible consequences of root-level compromise. These are potential outcomes, not observed activity established by the supplied incident reporting.

The exploitation and root/miner claims are **single-sourced; verify before enforcement**. The GitHub advisory corroborates the vulnerability and fixed versions but does not corroborate exploitation. No threat actor is identified, and no attribution can be made.

## 4\. Mitigation & containment

### P1 — within 24 hours

1. **Identify exposed systems.** Inventory Macs with Screen Sharing enabled and determine whether port 5900 is reachable from the internet, untrusted internal segments, router port forwards, public addresses or hosting-provider networks.
2. **Patch immediately.** Update each supported branch to at least:
- macOS Tahoe 26.6.1
- macOS Sequoia 15.7.9
- macOS Sonoma 14.8.9

Use **Apple menu → System Settings → General → Software Update → Update Now**. Older systems may expose Software Update directly under System Preferences. Allow any required restart and verify the installed version after completion.

1. **Contain unpatched exposure.** If immediate updating is impossible, use **System Settings → General → Sharing** and turn **Screen Sharing** off. Remove public port forwarding and block inbound access to port 5900 until the fix is installed.
2. **Review Remote Management separately.** Disable **Remote Management** on the same Sharing page unless it is explicitly required for authorised support. The supplied material does not state that CVE-2026-65400 affects Remote Management; this is attack-surface reduction.
3. **Isolate suspected compromises.** Disconnect systems showing unexplained remote-control sessions, root-level activity or mining behaviour before updating. Preserve available endpoint, authentication and network telemetry.

### P2 — within 72 hours

1. Confirm through endpoint-management inventory that patched versions are installed; do not rely solely on update deployment status.
2. Re-scan external and internal exposure points for reachable port 5900 and investigate undocumented forwarding rules or public assignments.
3. Hunt available telemetry for unexpected Screen Sharing sessions, subsequent root-level execution and sustained unexplained CPU/GPU workloads consistent with mining.
4. Where compromise is confirmed or root access cannot be excluded, rebuild the Mac from trusted media and rotate credentials and keys accessible from that host. Patching alone does not remove an installed payload or persistence.

### P3 — within seven days

1. Enforce a managed baseline that disables Screen Sharing and Remote Management unless an approved business requirement exists.
2. Restrict approved Screen Sharing access to explicitly authorised network segments and document all exceptions.
3. Review affected-system telemetry across the available retention period for earlier remote-control and mining activity.
4. Add verification of macOS Screen Sharing exposure and fixed OS versions to recurring vulnerability and configuration assessments.

## 5\. Indicators of compromise

No atomic indicators of compromise are available in the source material.

### Behavioural indicators

| Behaviour                                                                                                          | Where to observe                                                                                      | Confidence                                                                |
| ------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------- |
| Unexpected Screen Sharing authentication or remote-control session without corresponding valid-credential activity | Screen Sharing authentication/session telemetry, endpoint telemetry and network records, if collected | High for vulnerability capability; not specific to the reported incidents |
| Unexpected inbound connection to an enabled Screen Sharing service on port 5900                                    | Firewall, flow, router and hosting-provider telemetry                                                 | Medium; legitimate administration may produce the same behaviour          |
| Root-level activity followed by installation or execution of Monero-mining software                                | EDR process and privilege telemetry; CPU/GPU workload monitoring                                      | Low–medium; incident claim is single-sourced; verify before enforcement   |

## 6\. Detection

Insufficient indicators to author detection rules.

## CVE assessment

1 referenced CVE — 1 critical (CVSS ≥ 9.0)

| CVE                                                                              | CVSS         | Exploited | EPSS | Summary                                                                                                                          |
| -------------------------------------------------------------------------------- | ------------ | --------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- |
| [CVE-2026-65400](https://nvd.nist.gov/vuln/detail/CVE-2026-65400?ref=f4n6.co.uk) | 9.8 Critical | —         | 0%   | An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma… |

## 7\. Sources

- Malwarebytes, “Update your Mac: Screen Sharing vulnerability exploited in the wild,” https://www.malwarebytes.com/blog/bugs/2026/08/update-your-mac-screen-sharing-vulnerability-exploited-in-the-wild, 2026-08-17.
- GitHub Security Advisories, “An authentication issue was addressed with improved state management,” https://github.com/advisories/GHSA-cwph-f4w9-f4wq, date not provided in the supplied material.

## 8\. Adverse Trace position

Adverse Trace treats CVE-2026-65400 according to the authoritative rating of **CVSS 9.8 CRITICAL**, **CWE-287 (Improper Authentication)**, **not listed in CISA KEV**, with **EPSS 0%**. P1 action is warranted for Macs with enabled, network-reachable Screen Sharing, particularly internet-exposed systems; service-disabled systems have lower immediate exposure but should still receive the fixed release. The reported exploitation, root access and Monero deployment are single-sourced and must be verified before IOC-based enforcement or attribution. Adverse Trace will monitor for independent confirmation, changes to CISA KEV status, Apple or NCSC technical disclosures, and publication of exploitable artefacts or validated indicators.

---

[Read the original source →](https://www.malwarebytes.com/blog/bugs/2026/08/update-your-mac-screen-sharing-vulnerability-exploited-in-the-wild?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*