CVE-2026-65400: macOS Screen Sharing Authentication Bypass Reported Under Active Exploitation
Summary
CVE-2026-65400 allows network attackers to bypass macOS Screen Sharing authentication. Apple patched supported releases; CISA lists it as exploited, and NCSC-NL reported exposed Macs compromised with XMRig. Researchers' detailed root-cause account remains partly unestt.
Key points
- Apple says the flaw may let a network attacker authenticate to Screen Sharing without valid credentials; it patched Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9.
- Independent research describes an authentication state-management weakness involving malformed SRP input; the exact packet-level mechanism remains research-derived and disputed across analyses.
- Because screensharingd runs as root, bypassing authentication may expose privileged file-transfer operations; further code execution or persistence depends on writable locations and macOS protections.
- NCSC-NL reported that attackers compromised internet-exposed Macs and deployed the XMRig miner; this reporting does not establish compromise of every exposed host.
- CISA added CVE-2026-65400 to its Known Exploited Vulnerabilities Catalog and set an August 21, 2026, federal remediation deadline.
- An underground forum poster's claim of roughly 24,000 hosts with TCP/5900 exposed is unverified; an open port alone does not establish a vulnerable or compromised Mac.
- The article recommends installing the applicable Apple update, disabling unnecessary Screen Sharing, blocking public TCP/5900 access, and investigating previously exposed systems.
Article Details
- Attack Vectors
- An attacker who can reach macOS Screen Sharing over TCP/5900 may exploit CVE-2026-65400 before authentication; Apple confirmed that a network attacker may authenticate without valid credentials.
- Independent research attributes the bypass to malformed SRP input and authentication-state handling errors. The exact packet-level trigger and its precise relationship to CVE-2026-65400 remain uncertain.
- After a successful bypass, the attacker may access privileged file-transfer operations through SSFileCopySender and SSFileCopyReceiver. File access may enable data theft and, where suitable writable locations exist, persistence or code execution; the vulnerability does not directly guarantee code execution.
- NCSC-NL reported incidents involving compromised internet-exposed Macs and deployment of the XMRig miner. An open TCP/5900 port alone does not establish that a host is a vulnerable Mac or was compromised.
- Defensive Notes
- Install the applicable Apple security update: macOS Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9.
- Disable Screen Sharing if it is not needed. Otherwise, restrict TCP/5900 to trusted networks and use a VPN, firewall policy, or jump host rather than exposing it directly to the Internet.
- Investigate systems that were reachable over TCP/5900 while running vulnerable versions; the article recommends treating them as potentially compromised until forensic checks are complete.
- Hunt for XMRig, unexpected SSH authorized keys, unauthorized LaunchDaemons, modified firewall rules, and unusual Screen Sharing activity. The article identifies some persistence indicators as plausible investigation targets, not confirmed artifacts of the reported incidents.
- Review /tmp or ~/Downloads for xmrig-related files; the article reports these as observed XMRig payload locations in the cited incidents.
MITRE ATT&CK
T1005 · Data from Local SystemThe public panchocosil PoC reads local root-only files, including /etc/sudoers, /etc/passwd, and /etc/master.passwd, after triggering the authentication bypass.T1190 · Exploit Public-Facing ApplicationCVE-2026-65400 was reportedly exploited against internet-exposed Macs through the Screen Sharing service reachable over TCP/5900.T1496 · Resource HijackingNCSC-NL reported XMRig cryptocurrency-miner deployment on Macs compromised through the exposed Screen Sharing service.T1543.004 · Launch DaemonThe article says the acheong08 PoC adds arbitrary file writing, including writing LaunchDaemon plists for persistence; it does not establish that this persistence method was used in the reported incidents.
CVE
People
Malware
Vendors
Products
Tools
acheong08/CVE-2026-65400acheong08/CVE-2026-65400 — extended Python PoC derived from the read-only version that adds arbitrary file write and achieves RCE. It can write LaunchDaemon plists for persistence or overwrite existing privileged helperHORKimhab/CVE-2026-65400HORKimhab/CVE-2026-65400 — draft PoC with read, write, and exec commands, including reverse-shell capability (reportedly SIP-disabled only).initconf/zeek-screensharing-rceinitconf/zeek-screensharing-rce — Zeek detection package that observes the same protocol artifacts in network traffic.masscanMasscan and zmap are the most common high-speed scanners.navi_the_clownJuly 29, 2026 fG! publishes "It's a pre-auth, stupid!" describing the first bypass and a read-only PoC named navi_the_clown. https://reverse.put.as/2026/07/29/its-a-pre-auth-stupid/Nmapnmap -p 5900 --open -Pn target-range.example.com/24panchocosil/CVE-2026-65400-pocpanchocosil/CVE-2026-65400-poc — read-only Python PoC. It connects to TCP/5900, performs the RFB/SRP handshake, triggers the pre-auth bypass, and reads root-only files such as /etc/sudoers, /etc/passwd, andzmapMasscan and zmap are the most common high-speed scanners.