Apple Patches Pre-Authentication macOS Screen Sharing Flaw Enabling Root Access
Summary
CVE-2026-65400 lets attackers exploit macOS Screen Sharing for pre-authentication root file access and remote code execution. Apple patched supported versions on August 6, 2026; disable Screen Sharing if you cannot update.
Key points
- A flaw in Screen Sharing’s Secure Remote Password implementation can bypass authentication and leave the session unprotected.
- Successful exploitation can allow arbitrary file reads and writes as root, and potentially remote code execution.
- The flaw affects supported macOS versions before Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9.
- Apple released the fixes on August 6, 2026. Update macOS, or disable Screen Sharing until patching is possible.
- Removing allowed users, disabling legacy VNC authentication, or changing its password does not prevent exploitation.
- Huntress describes detection opportunities in Endpoint Security events, including suspicious root Screen Sharing sessions and file operations by SSFileCopySender.
Article Details
- Vulnerability Types
- Pre-authentication authentication bypass
- Arbitrary file read and write
- Remote code execution
- Affected Versions
- CVE-2026-65400: macOS versions prior to 26.6.1, 15.7.9, and 14.8.9; the article specifies vulnerable versions ≤ 26.5.2, ≤ 15.7.7, and ≤ 14.8.7 for the demonstrated PoC
- CVE-2026-43760: affected versions are not specified
- Exploitation Status
- reported
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- Disable Screen Sharing if patching is not immediately possible.
MITRE ATT&CK
T1210 · Exploitation of Remote ServicesThe public PoC exploits the Screen Sharing service remotely to bypass authentication and access files or achieve code execution.T1543.004 · Launch DaemonThe article describes achieving persistence and execution by creating a LaunchDaemon that runs an on-disk reverse shell upon reboot.T1546.004 · Unix Shell Configuration ModificationThe article describes modifying a shell startup file such as .zshenv to trigger execution when Terminal.app opens.
CVE
People
bl4styReversed the PoC, analyzed the authentication bypass, and built a read/write and RCE PoC.Bryan MastersAcknowledged for contributions to the investigation and write-up.fG!Alias of Pedro Vilaça; published a post and an obfuscated proof-of-concept binary concerning the pre-authentication bug.Pedro VilaçaPublished a post confirming a pre-authentication bug had been patched; the article identifies fG! as his alias.Ryan DowdArticle author.Stuart AshenbrennerAcknowledged for contributions to the investigation and write-up.
Vendors
Products
Tools
esloggerWhen subscribed to ES_EVENT_TYPE_NOTIFY_SCREENSHARING_ATTACH via eslogger, Apple's tool for subscribing to user-specified ES events, we can observe the following for successful exploitation:navi_the_clowna separate pre-authentication bug had been patched, alongside an obfuscated, read-only PoC binary (navi_the_clown).