CISA added CVE-2026-65400, an authentication bypass in macOS’s built-in Screen Sharing service, to its Known Exploited Vulnerabilities catalog on August 18, 2026, as part of a four-CVE batch update. The bug lets a remote, unauthenticated attacker log into screensharingd on any Mac with the service reachable over the network, land with root, and — in every case documented so far — get a Monero cryptominer dropped on the box.

What happened

Screen Sharing is macOS’s built-in VNC-compatible remote-desktop daemon, bound by default to TCP port 5900 when enabled. screensharingd failed to properly validate credentials during the authentication handshake, allowing a crafted connection to bypass the login prompt entirely and reach an authenticated session without a valid username or password. Any Mac with Screen Sharing turned on and port 5900 reachable from an untrusted network — a home Mac mini exposed for remote access, a build machine on a misconfigured cloud VPC, a self-hosted CI runner — is a direct target.

Apple shipped a fix on August 6, 2026 in an out-of-band update (macOS Tahoe 26.6.1, Sequoia 15.7.9, Sonoma 14.8.9), originally rating the bug 7.1. The Dutch National Cyber Security Centre (NCSC-NL) reported active exploitation on August 12, and once public proof-of-concept code surfaced, CISA revised the CVSS score up to 9.8 critical on August 14 before adding it to KEV on August 18. In every reported incident, attackers who bypassed authentication came out with root and immediately installed an XMRig-style Monero miner — this is opportunistic cryptojacking against internet-facing hosts, not a targeted intrusion, which is exactly the profile that scales fastest against unpatched, exposed services.

Technical details

  • CVE: CVE-2026-65400, CVSS 9.8 (Critical, revised up from 7.1)
  • Component: screensharingd, the daemon backing macOS Screen Sharing / Apple Remote Desktop’s VNC compatibility layer
  • Vector: Network, no authentication required, no user interaction — a crafted connection to the exposed service (default port 5900) completes the login handshake without valid credentials
  • Impact: Full root access to the host
  • Affected: macOS versions prior to Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9
  • Fixed in: macOS Tahoe 26.6.1, Sequoia 15.7.9, Sonoma 14.8.9 (released August 6, 2026)
  • Observed payload: Monero (XMRig-family) cryptominers dropped post-compromise

Impact

This hits any organization or individual running a Mac with Screen Sharing enabled and port 5900 reachable from the internet — cloud-hosted Mac build agents (common in iOS/macOS CI pipelines), Mac minis colocated for remote development or QA, and any host where port forwarding or a misconfigured security group exposes the service outside a trusted network. Because the exploit yields root directly, a compromised host isn’t limited to being a mining rig: an attacker with root on a CI build agent has a foothold to tamper with build artifacts, harvest signing credentials, or pivot into whatever network segment the machine sits in. The current campaign is mining-focused, but the access level available makes follow-on abuse (credential theft, supply-chain tampering on build infrastructure) a real possibility, not a hypothetical.

Mitigation

  • Patch immediately to macOS Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9.
  • Audit which Macs have Screen Sharing enabled and confirm port 5900 (and related ARD ports) are not reachable from the public internet — disable Screen Sharing entirely on any host that doesn’t need it, especially cloud-hosted build/CI Macs.
  • Where remote access to a Mac is genuinely required, put it behind a VPN or bastion rather than exposing 5900 directly, and enforce that at the cloud security-group / firewall layer independent of patch status.
  • Check for indicators of compromise: unexpected CPU load, unfamiliar processes consuming resources, unrecognized outbound connections to mining pool infrastructure, and unexpected local admin accounts.
  • Given public PoC availability and confirmed in-the-wild exploitation, treat any unpatched, internet-reachable instance as compromised until verified otherwise.

Sources