Critical macOS Screen Sharing flaw gives attackers remote root access — CISA bumps bug to 9.8 severity following active Monero cryptojacking attacks

The Dutch National Cyber Security Centre (NCSC-NL) reported on August 12 that attackers are actively exploiting CVE-2026-65400, an authentication bypass in macOS Screen Sharing, to compromise Macs with port 5900 exposed to the Internet. In every case reported to the agency, attackers obtained root access and installed a Monero cryptocurrency miner. Apple patched the flaw on August 6 in an out-of-band update covering macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9, but the bug’s official severity has since been rewritten, with CISA raising its CVSS score from 7.1 to 9.8 critical on August 14, now assessing the attack as automatable.

NCSC-NL first flagged the vulnerability in an advisory on August 7, a day after Apple’s patch, urging organizations to update immediately. The August 12 revision added that public proof-of-concept code is now available and that active abuse had been observed on multiple internet-exposed systems.

Technical details of the bug were presented at last week’s Black Hat conference, according to Ars Technica, alongside a video of the exploit in action. The root-level access attackers gained in the reported incidents matches the level of control researchers demonstrated in May, when they bypassed Memory Integrity Enforcement on Apple’s M5 silicon with AI assistance.

NVD’s change log for CVE-2026-65400 shows CISA initially scored the bug at 7.1 on August 6, using a vector that assumed an attacker needed low-level privileges and could achieve only partial impact. On August 14, the agency replaced that vector with one requiring no privileges and granting full compromise of confidentiality, integrity, and availability, raising the score to 9.8. A day later, CISA’s decision record for the flaw flipped from “not automatable” to automatable, an assessment consistent with unattended Macs being rooted at scale for coin mining.

The flaw still isn’t in CISA’s Known Exploited Vulnerabilities catalog as of this writing. The same decision record also still lists exploitation as “none,” despite the NCSC-NL report. Users who can’t update immediately can turn Screen Sharing off under System Settings > General > Sharing.

Apple’s advisory says an attacker on the network may be able to “authenticate to Screen Sharing without valid credentials,” and describes the fix as improved state management during authentication. Screen Sharing is the VNC-based remote desktop service built into macOS, listening on TCP port 5900, which is disabled by default. The August 6 update comes just 10 days after Apple’s July 27 security round and fixes only this single CVE, representing the second Screen Sharing patch in a month. CVE-2026-43760, which required valid credentials to exploit, was fixed in the late-July releases.