The short answer
CVE-2026-65400 is a pre-authentication remote code execution flaw in macOS Screen Sharing. The Dutch NCSC-NL confirmed active exploitation on August 12, 2026: attackers scan for internet-exposed Macs on TCP port 5900, bypass the Secure Remote Password authentication with a single malformed packet, gain root access, and install a Monero cryptocurrency miner. Apple patched the flaw in an emergency update on August 6. CISA rescored severity from 7.1 to CVSS 9.8 on August 14. Any macOS device with Screen Sharing enabled and port 5900 accessible from the internet must be patched or hardened immediately.
What CVE-2026-65400 does
Screen Sharing on macOS uses the VNC protocol over TCP port 5900. Authentication is handled by screensharingd, the system daemon that implements Apple's Secure Remote Password (SRP) exchange — a zero-knowledge proof designed to verify a user knows the account password without transmitting it in the clear.
CVE-2026-65400 lives in the frame-length validation path of that SRP implementation. When the daemon processes certain malformed client frames, it reads a stale success state from an earlier point in the handshake and interprets it as completed authentication — before the user has proved knowledge of any password. The result is that screensharingd grants the attacker a fully authenticated VNC session running as root. No username, no password, no user interaction required.
A penetration test or security audit of any environment running macOS endpoints with port 5900 exposed would flag this as a critical finding requiring immediate remediation. The attack is automatable at scale: scanning the internet for port 5900 and sending the malformed handshake packet is a single-step operation that any competent threat actor can operationalize in hours.
Active exploitation: root access and Monero
The Dutch National Cyber Security Centre (NCSC-NL) issued an alert on August 12, 2026, reporting that attackers are actively exploiting CVE-2026-65400 against Macs with port 5900 exposed to the public internet. In every case reported to the agency, the attacker achieved root access and installed a Monero (XMR) cryptocurrency miner, consuming the host's CPU at maximum capacity.
Monero is the attacker's preferred currency for cryptojacking because its randomized proof-of-work algorithm (RandomX) runs efficiently on consumer CPUs rather than GPUs, and its transaction graph is not publicly traceable — making attribution and fund-freezing impossible. The payload observed is consistent with known Monero mining families distributed in recent Mac-targeting campaigns.
CISA added CVE-2026-65400 to its Known Exploited Vulnerabilities catalog on August 14, 2026, simultaneously rescoring the flaw from CVSS 7.1 to CVSS 9.8 Critical. The rescoring reflects the confirmed automatable attack, the absence of any authentication requirement, and the root-level impact across all reported incidents. Federal agencies under CISA's binding operational directives must remediate KEV entries within 14 days; the guidance for civilian organizations is to treat KEV entries as de-facto emergencies.
Who is at risk: dev machines and CI runners
The obvious surface is any Mac with Screen Sharing enabled and port 5900 reachable from outside a protected network perimeter. But the risk profile for software engineering organizations is broader than it first appears:
- Developer workstations: Engineers frequently enable Screen Sharing for pair programming, remote support, or when connecting from home. A home-office Mac, or a laptop that briefly connects to an open network with Screen Sharing on, is exposed to scanning-based exploitation.
- macOS CI runners: iOS and macOS development pipelines rely on macOS build agents (GitHub Actions self-hosted runners, GitLab CI runners, Jenkins agents). These machines often have Screen Sharing enabled to allow remote debugging of failed builds. A compromised CI runner can inject malicious code into build artifacts, exfiltrate signing certificates, or steal cloud credentials stored in the agent's environment.
- Remote-access Macs: Teams using macOS machines as jump boxes or remote desktop hosts — for instance to test Safari or iOS Simulator remotely — often configure port forwarding from public IPs to those machines.
A cryptominer payload is the opportunistic outcome. A targeted attacker gaining the same root access on a build machine has far more damaging options: persistent backdoors, certificate theft, source-code exfiltration, and supply-chain poisoning of software artifacts.
What it means for US & EU software teams
Build pipeline integrity is the highest-stakes risk here. A compromised macOS CI runner can tamper with software artifacts downstream. Every application signed on that machine after the compromise is suspect until the runner is re-imaged and re-attested. Teams shipping iOS or macOS apps should audit their CI macOS host inventory and confirm patching or isolation before next release.
Regulated industries face compounded exposure. HealthTech teams under HIPAA and FinTech teams under DORA or SOC 2 maintain requirements for vulnerability remediation timelines and controls over systems handling sensitive data. An actively exploited CVSS 9.8 flaw in production systems is a material risk event that belongs in the risk register with a documented remediation date. The CISA KEV listing reinforces this: for SOC 2 Type II purposes, KEV entries represent known exploited vulnerabilities with a clear remediation expectation.
Remote-work environments are underinventoried. Many engineering organizations lack complete visibility into which of their employees' personal or company-issued Macs have Screen Sharing enabled and are accessible from outside the corporate VPN. This incident is a prompt to run that inventory — a network scan for open port 5900 across company-managed endpoints is straightforward and takes minutes.
What to do now
| Action | Priority | Notes |
|---|---|---|
| Patch to macOS Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9 | Emergency — today | Apple's August 6 emergency update closes CVE-2026-65400. This is the only definitive fix. |
| Disable Screen Sharing if patching is delayed | Emergency | System Settings > General > Sharing > Screen Sharing — toggle off. Eliminates the attack surface immediately. |
| Block TCP port 5900 at the network perimeter | Emergency | Prevents exploitation even if Screen Sharing remains enabled on internal hosts that cannot be reached directly from the internet. |
| Audit macOS CI runners for Screen Sharing status and patch level | Critical — this sprint | Compromised build agents are a supply-chain risk. Re-image any runner with Screen Sharing that was unpatched while internet-exposed. |
| Scan for signs of compromise on exposed Macs | Critical — this sprint | High sustained CPU usage, unknown processes in Activity Monitor, new cron jobs or LaunchDaemons, unexpected outbound connections to pool.monero.* or mining-pool ranges. |
| Run a port scan for open 5900 across your managed endpoints | This week | Identify any device with Screen Sharing reachable from outside the corporate network and prioritize those for immediate patching or shutdown of the service. |
| Document remediation timeline for compliance records | Within 5 business days | SOC 2, HIPAA, DORA: KEV entries require documented evidence of remediation. Record patch dates and any compensating controls applied while patching was underway. |
Is your macOS build infrastructure exposed? YuSMP Group's penetration testing and security audit service covers macOS and iOS pipeline hardening, CI runner attack-surface assessment, and remediation guidance aligned to SOC 2, HIPAA, and DORA requirements. Get a scoped engagement started in days.
Sources: BleepingComputer — Hackers exploit macOS Screen Sharing flaw to deploy Monero miner (August 14, 2026); The Hacker News — Apple macOS Screen Sharing Flaw Actively Exploited to Mine Monero (August 15, 2026); Tom's Hardware — CISA bumps CVE-2026-65400 to 9.8 severity following active Monero cryptojacking attacks (August 14, 2026).
FAQ
What is CVE-2026-65400?
CVE-2026-65400 is an authentication bypass vulnerability in screensharingd, the macOS daemon that powers the built-in Screen Sharing (VNC) feature on port 5900. A faulty frame-length validation in the Secure Remote Password (SRP) exchange causes the service to return a stale success state before authentication completes, allowing an unauthenticated remote attacker to gain root access on any Mac with Screen Sharing enabled and port 5900 reachable from the internet. Apple patched it on August 6, 2026 in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9.
Which macOS versions are affected?
CVE-2026-65400 affects macOS across all versions that include the Screen Sharing feature — macOS Sonoma (up to 14.8.8), macOS Sequoia (up to 15.7.8), and macOS Tahoe (up to 26.6.0). The fix is available in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. Apply the update immediately. If immediate patching is not possible, disable Screen Sharing in System Settings > General > Sharing.
Why did CISA raise the severity to CVSS 9.8?
CISA originally inherited Apple's CVSS 7.1 score for CVE-2026-65400, but rescored it to 9.8 critical on August 14, 2026 after confirming that the attack is automatable, requires no user interaction, and is being actively exploited in the wild. A CVSS 9.8 rating means the attack complexity is low, no privileges are required, and the confidentiality, integrity, and availability impact are all rated High.
Are development machines and CI agents at risk?
Yes. Software engineers frequently enable Screen Sharing on macOS machines to allow pair programming or remote support. macOS-based CI runners (common in iOS and macOS development pipelines) sometimes have Screen Sharing enabled for debugging. Any of these machines with port 5900 reachable from outside a firewalled LAN are exposed. If compromised, attackers gain root access to source code, signing certificates, cloud credentials, and the build pipeline itself — making this a supply-chain risk, not just an endpoint hygiene item.
What should teams do immediately?
Three steps: (1) Apply the patch — update all macOS devices to Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9. (2) If patching is delayed, disable Screen Sharing in System Settings > General > Sharing and block TCP port 5900 at the network perimeter or host-level firewall. (3) Audit for compromise — scan for unexpected processes consuming high CPU (Monero miners saturate CPU), unusual outbound connections, and new accounts or cron jobs added without authorization.