Apple’s Screen Sharing Flaw Is Now Being Exploited on Internet-Exposed Macs
A macOS security update that could have looked like routine patching a few days ago has moved into the “yes, people are actually using this” category.
The vulnerability is CVE-2026-65400, an authentication flaw in macOS Screen Sharing. Apple patched it on August 6 in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. The problem can allow a network attacker to authenticate to Screen Sharing without valid login credentials.
On August 12, the Netherlands’ National Cyber Security Centre updated its advisory to say it had received reports of active exploitation on multiple systems where port 5900—the port commonly used for VNC and Screen Sharing—was reachable from the public internet. In the cases reported to the NCSC, attackers obtained root access and installed a Monero cryptocurrency miner.
Root access is the part to pay attention to. A cryptominer is annoying and expensive, but once an attacker has the highest level of control over a Mac, the miner is not the limit of what could have been installed. It is simply what investigators saw in these attacks.
This also illustrates an old security lesson that somehow keeps needing sequels: remote-management services should not be casually exposed to the public internet. Screen Sharing is useful. Port-forwarding it straight through a router so you can reach a Mac from anywhere is convenient. It also turns that Mac into something every automated scanner on the internet can knock on all day and all night.
If you use one of the affected macOS versions, install the current update. If you administer Macs and expose Screen Sharing or VNC externally, verify that those systems are patched and strongly consider putting remote access behind a VPN or another controlled access layer instead of leaving port 5900 open to the world.
And if an internet-facing Mac remained unpatched while this exploitation was occurring, patching is only half the job. It is worth checking the machine for unexpected processes, new persistence mechanisms, unusual accounts, and other signs that somebody arrived before the update did.
There is no need for panic here. Most Macs do not have Screen Sharing exposed directly to the internet. But for the ones that do, this has graduated from a theoretical vulnerability to a demonstrated attack path.