macOS ‘Screen Sharing’ flaw exploited for crypto-mining

A feature designed to let people remotely control a Mac has become an entry point for attackers.

The Netherlands’ National Cyber Security Centre (NCSC-NL) says threat actors have exploited a recently patched macOS Screen Sharing vulnerability on multiple internet-accessible systems. In each reported case, the attackers obtained root-level access and installed a Monero cryptocurrency miner.

The vulnerability, tracked as CVE-2026-65400, can let a remote attacker bypass authentication and access Screen Sharing without credentials. Apple fixed the flaw on Aug. 6 in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9.

Key takeaways

• CVE-2026-65400 lets attackers bypass authentication on Macs with Screen Sharing enabled
• NCSC-NL says the flaw has been exploited against multiple systems exposing port 5900 to the internet
• Attackers reportedly gained root access and installed Monero cryptocurrency miners
• The vulnerability affects macOS Tahoe, Sequoia and Sonoma versions released before Aug. 6
• Mac users should update immediately and disable Screen Sharing when it is not needed
• A Mac that may already be compromised should be treated as fully breached, even after it is updated

What is macOS Screen Sharing?

Screen Sharing is Apple’s built-in remote desktop feature. When enabled, it lets someone on another computer view and control a Mac over a network.

As Apple explains, Screen Sharing can be used to open, move and close files, launch applications, and restart a remote Mac. The service uses the Remote Framebuffer protocol, commonly associated with Virtual Network Computing, or VNC, and normally listens on TCP port 5900.

Screen Sharing is not enabled by default on a standard Mac. However, it may be activated on remotely managed workstations, development systems and hosted Mac mini or Mac Studio servers. Some of these devices are intentionally made accessible over the internet, significantly increasing their exposure.

CVE-2026-65400 affects the service’s authentication. Apple’s Sonoma security advisory said the company addressed the issue by improving state management. Apple warned that an attacker on the network might be able to authenticate to Screen Sharing without valid credentials.

How the vulnerability bypasses authentication

The vulnerability involves macOS’s implementation of Secure Remote Password authentication inside the screensharing service.

A technical analysis found that an error in the service’s frame-length validation could cause it to return an outdated success status. As a result, the service may treat an unauthenticated connection as legitimate and allow it to continue without the expected cryptographic protection.

Once connected, an attacker can reportedly abuse Screen Sharing’s privileged file-handling components to read or create files with root-level permissions. That access can then be used to establish persistence or run malicious commands.

Exploitation does not require a valid macOS account, a VNC password or any action from the victim. The CISA vulnerability enrichment data displayed by the National Vulnerability Database assigns it a critical CVSS score of 9.8.

The flaw is separate from CVE-2026-43760, a recently disclosed Screen Sharing vulnerability. CVE-2026-43760 requires an attacker to know a configured VNC password, while CVE-2026-65400 can reportedly be exploited before authentication.

Attackers are installing Monero miners

NCSC-NL initially published its advisory on Aug. 7 and updated it on Aug. 12 after reports of active exploitation.

The agency said attacks were observed on multiple systems where port 5900 was directly accessible from the internet. The attackers obtained root access and installed software that used the Macs to mine Monero cryptocurrency.

Cryptojacking malware quietly consumes a device’s processing power to generate cryptocurrency for its operators. Victims may notice excessive CPU use, increased power consumption, overheating or degraded performance.

The miner is only the visible part of the incident, however. Root access gives the attackers control over the entire system. They may be able to steal files and credentials, install additional backdoors, tamper with security tools or use the Mac as a foothold for attacks elsewhere on the network.

NCSC-NL has not disclosed how many systems were compromised, when the attacks began or whether the attackers deployed other malware. Public proof-of-concept code has also been analyzed by security researchers, increasing the risk to Macs that remain unpatched and exposed.

Which Macs are affected?

Apple has released fixes in the following versions:

• macOS Tahoe 26.6.1
• macOS Sequoia 15.7.9
• macOS Sonoma 14.8.9

Earlier versions in these release families should be considered vulnerable. Macs running older, unsupported versions of macOS may not receive the fix and should be upgraded to a supported release.

The most immediate risk applies to Macs that have Screen Sharing enabled and are reachable from untrusted networks, especially systems exposing TCP port 5900 directly to the internet.

Hosted Macs, build servers and remotely administered devices deserve particular attention. Huntress researchers noted that some hosted bare-metal Mac services may provision devices with remote-access services enabled or with older macOS images that remain vulnerable until updated.

How to protect your Mac

Install the latest macOS update

Open System Settings > General > Software Update and install all available updates.

Updating is the only way to correct the underlying authentication flaw. Password changes and account restrictions do not prevent exploitation of CVE-2026-65400 on an otherwise vulnerable system.

Disable Screen Sharing if you don’t use it

Follow Apple’s instructions for changing Sharing settings or go to System Settings > General > Sharing and turn off Screen Sharing.

Organizations should also check whether Remote Management or related remote-access services are enabled through device-management policies.

Keep port 5900 off the public internet

Screen Sharing should not be exposed directly to the internet. Restrict access with a properly configured firewall, a trusted VPN or IP allowlisting.

Administrators should scan their own address ranges for exposed VNC services rather than assuming existing firewall rules are working as intended.

Use a trusted security solution

It’s always advisable to run a trusted security solution on your Mac in case you’re caught off guard. Bitdefender Antivirus for Mac offers real-time protection against malware infection, adware blocking, VPN, protection for all your browsing (including online shopping and banking), and Time Machine Protection for your backed-up files in case of a ransomware attack.

Look for signs of compromise

Based on the detection guidance published by Huntress, warning signs can include:

• Sustained or unexplained high CPU usage
• Unknown processes or startup items
• Connections to cryptocurrency-mining pools
• Unexpected Screen Sharing sessions, especially sessions associated with root
• Newly created LaunchDaemons or modified shell startup files
• Unexplained changes to firewall or remote-access settings

A trusted security solution can help detect cryptocurrency miners, malicious persistence and other suspicious activity. Business administrators should review endpoint security and network telemetry for unusual Screen Sharing activity.

Treat suspected root access as a full breach

Do not simply remove the visible miner and continue using the device. An attacker with root privileges may have installed additional means of persistence that is hard to identify. The safest recovery path generally involves preserving relevant evidence, erasing the Mac and reinstalling macOS from a trusted source.

Credentials, API tokens, SSH keys and other secrets stored on or used from the affected Mac should also be rotated from a device know to be clean.

Most home users face limited immediate risk if Screen Sharing has never been enabled. Anyone operating remotely accessible Macs should act quickly:

• install macOS Tahoe 26.6.1, Sequoia 15.7.9 or Sonoma 14.8.9
• remove port 5900 from the public internet
• investigate exposed systems for signs of earlier compromise

Remember that while patching closes the vulnerability, it does not undo an intrusion that has already happened.

You may also like:

Crypto investment scam sends couriers to collect victims' cash, FBI warns

US indicts three Russians accused of powering global cybercrime

The money trail behind investment scams