The **Netherlands National Cyber Security Centre (NCSC-NL)** has issued a stark warning: a critical security vulnerability in **Apple macOS**, identified as **CVE-2026-65400**, is actively being exploited in the wild. This flaw, boasting a CVSS score of 9.8, affects the Screen Sharing component and allows attackers already on the network to authenticate without valid credentials, leading to the deployment of cryptocurrency miners. ## The Vulnerability: CVE-2026-65400 **CVE-2026-65400** is an authentication issue within **macOS**'s built-in remote desktop feature. **Apple** addressed this shortcoming in emergency updates for **macOS Tahoe 26.6.1**, **macOS Sequoia 15.7.9**, and **macOS Sonoma 14.8.9** earlier this month. The fix improves state management mechanisms to enforce correct credential validation, preventing unauthorized access. **Apple** credited security researcher **Alfredo Pesoli** of **Bynario** for discovering and reporting the issue. ## Active Exploitation and Crypto Mining **NCSC-NL** reported receiving intelligence of active abuse across numerous systems where port 5900 was exposed to the internet. In these observed instances, attackers gained root access and installed a **Monero** crypto miner. Details regarding the full scale of these attacks, the exact timeline, or whether the flaw was exploited as a zero-day are currently limited. ## A Series of Screen Sharing Flaws **Calif**, an AI security company, provided additional insights, linking **CVE-2026-65400** to a series of bugs in the Screen Sharing Server component patched by **Apple** in **macOS Tahoe 26.6**. These include: * **CVE-2026-43779** (CVSS: 9.8): A logic issue enabling an app to intercept network connections. * **CVE-2026-43777** (CVSS: 7.5): An unspecified issue leading to remote denial-of-service. * **CVE-2026-43760** (CVSS: 8.6): An access issue allowing apps to access sensitive user data. **Pesoli** described **CVE-2026-43760** as a post-authentication bug requiring Screen Sharing or Remote Management to be enabled with VNC password control. He detailed how a legacy authentication path could be manipulated to turn a file copy operation into protected file disclosure, arbitrary root file creation, and remote root command execution. ## The Pre-Authentication Revelation Separately, a security researcher known as **@osxreverser** publicly disclosed a distinct pre-authentication vulnerability in the Screen Sharing daemon (**screensharingd**). This bug, also fixed in **macOS 26.6**, allows an attacker to gain root access to any Mac with Screen Sharing enabled, simply by knowing its IP address, without needing a password. **@osxreverser** noted they had been aware of this flaw for some time but chose not to report it to **Apple**. Interestingly, both **@osxreverser**'s bug and **CVE-2026-65400** reside in the same source code file. **Calif** explained that **@osxreverser**'s bug is a "single wrong return" leading to an early bailout in a length check, which the caller interprets as a successful authentication step. **CVE-2026-65400**, on the other hand, is a "state machine desync." Both are logic bugs that enable remote root access with minimal effort. ## The AI Factor in Exploitation **Calif** highlighted the alarming speed at which exploits can be developed for these flaws, particularly with the aid of AI. The company claimed to have developed working exploits for both vulnerabilities within four hours, demonstrating how AI is rapidly closing the gap between vulnerability discovery and weaponization. ## Recommendations for Users Given the active exploitation, it is critical for all **macOS** users, especially IT security professionals and privacy-conscious individuals, to update their systems to the latest available versions immediately. If immediate patching is not feasible, **Apple** advises disabling Screen Sharing by navigating to General > Sharing > Toggle Screen Sharing. This incident serves as a crucial reminder of the persistent threat landscape and the importance of timely security updates.