macOS Screen Sharing Flaws Enabled Pre-Auth Root Access; CVE-2026-65400 Exploited
Summary
Multiple macOS Screen Sharing flaws enabled root-level access, including authentication bypasses. Apple patched them, but CVE-2026-65400 was exploited against internet-exposed Macs to install cryptocurrency miners.
Key points
- CVE-2026-43760 let clients authenticated with a legacy VNC password use privileged file-copy helpers to read or write files as root; Apple patched it in macOS Tahoe 26.6 and Sonoma 14.8.8.
- Researchers identified a separate pre-authentication flaw caused by stale success state in screensharingd’s SRP frame-length validation, allowing access to the file-copy protocol without credentials.
- Apple’s July 27 update also inadvertently fixed that flaw, according to the researchers; Apple did not publicly assign it a CVE.
- Apple released macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9 on August 6 to fix the independent authentication bypass CVE-2026-65400.
- The Netherlands NCSC reported active exploitation of CVE-2026-65400 against internet-exposed Macs, with compromised systems gaining root access and running a Monero miner.
- Microsoft observed attackers adding persistence, removing traces, changing firewall settings, and deploying XMRig through a KeepAlive LaunchDaemon.
Article Details
- Vulnerability Types
- Screen Sharing authentication bypass caused by stale success value in SRP frame-length error handling
- Screen Sharing authentication bypass caused by state-machine desynchronization
- Insufficient authorization in privileged file-copy helpers under legacy VNC authentication
- Denial of service caused by input validation issue
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- available
MITRE ATT&CK
T1059 · Command and Scripting InterpreterAfter compromising Macs through Screen Sharing, attackers transferred scripts and used them in follow-on activity.T1070.003 · Clear Command HistoryAttackers removed command history and logs to remove evidence.T1098.004 · SSH Authorized KeysAttackers installed an SSH public key on compromised Macs for persistence.T1496.001 · Compute HijackingAttackers deployed XMRig 6.26.0 to mine Monero on compromised Macs.T1543.004 · Launch DaemonAttackers established persistence with a KeepAlive LaunchDaemon that relaunched the miner.T1562.004 · Disable or Modify System FirewallAttackers changed macOS Packet Filter settings.
CVE
CVE-2026-43760The original disclosure: CVE-2026-43760CVE-2026-43777It contained three screen sharing Server entries on Tahoe, including CVE-2026-43760 and CVE-2026-43777, which Apple described only as a remotely triggerable denial of service fixed through improved input validation.CVE-2026-65400On August 6, 2026, Apple unexpectedly released macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9 specifically to address another Screen Sharing authentication vulnerability, CVE-2026-65400.
People
Alfredo PesoliBynario researcher who disclosed CVE-2026-43760; Apple credited him via Bynario Atlas for CVE-2026-65400.bl4styReverse-engineered the navi_the_clown binary and analyzed the pre-authentication flaw.CalifDiffed macOS binaries and reported working exploits for two pre-authentication bugs.Pedro VilaçaIndependently found a pre-authentication Screen Sharing flaw and published a limited, obfuscated proof of concept.
Malware
Vendors
AppleOne required a legacy VNC password, another allowed authentication to be bypassed entirely, and a third related pre-authentication flaw forced Apple to ship an unusual out-of-band macOS update only days later.MicrosoftMicrosoft Threat Intelligence subsequently reported telemetry showing similar attacks.
Products
macOSIn late July 2026, a cluster of vulnerabilities in macOS Screen Sharing turned what initially looked like a fairly constrained privilege problem into one of the more interesting macOS remote-attack stories in years.Screen SharingIn late July 2026, a cluster of vulnerabilities in macOS Screen Sharing turned what initially looked like a fairly constrained privilege problem into one of the more interesting macOS remote-attack stories in years.XMRigThey transferred scripts and an SSH public key, modified system configuration, removed evidence such as command history and logs, changed macOS Packet Filter settings, and deployed XMRig 6.26.0 for cryptocurrency mining.