Apple macOS Screen Sharing Flaw CVE-2026-65400 Exploited to Deploy Monero Miner on Exposed Macs

A critical authentication bypass vulnerability in Apple macOS Screen Sharing, tracked as CVE-2026-65400 (CVSS 9.8), is being actively exploited in the wild to install Monero cryptocurrency miners on internet-exposed Macs. The Netherlands National Cyber Security Centre (NCSC-NL) issued a warning after receiving reports of active abuse across multiple systems with port 5900 accessible from the internet. In all observed cases, attackers gained root access and deployed a Monero miner.

Apple addressed the flaw in emergency updates released on August 6, 2026, for macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9. The issue was discovered and reported by security researcher Alfredo Pesoli of Bynario. Apple’s advisory states that the authentication issue was resolved with improved state management.

Further analysis by security firm Calif revealed that CVE-2026-65400 is part of a series of Screen Sharing Server bugs patched in macOS Tahoe 26.6, including CVE-2026-43779 (CVSS 9.8), CVE-2026-43777 (CVSS 7.5), and CVE-2026-43760 (CVSS 8.6). Pesoli described CVE-2026-43760 as a post-authentication bug that could lead to protected file disclosure, arbitrary root file creation, and remote root command execution when VNC password authentication is enabled.

Additionally, a security researcher known as @osxreverser disclosed a separate pre-authentication vulnerability in the Screen Sharing daemon (screensharingd) that allows unauthenticated remote compromise of any Mac with Screen Sharing enabled. This bug, also fixed in macOS 26.6, was reportedly not reported to Apple due to the researcher’s history with the company. @osxreverser noted that approximately 40,000 open Screen Sharing hosts are exposed on the internet, many in the U.S., including residential IPs and university networks.

Calif stated it is withholding technical details of CVE-2026-65400 until most users have patched, given the ease with which exploits can be developed using AI agents. The company demonstrated working exploits for both pre-auth flaws in just four hours, highlighting how AI is accelerating vulnerability weaponization. Users are strongly advised to apply the latest macOS updates immediately or disable Screen Sharing if patching is not possible.