Hackers Exploit macOS Screen Sharing Flaw to Install Monero Miner
Summary
The Netherlands’ NCSC says attackers are exploiting macOS Screen Sharing flaw CVE-2026-65400 on systems with port 5900 exposed, gaining root access and installing a Monero miner. Apple has released fixes and users are urged to update.
Key points
- The Netherlands’ NCSC says it received a report of active exploitation on multiple systems with TCP port 5900 exposed to the internet.
- CVE-2026-65400 is an authentication bypass in macOS Screen Sharing over VNC; attackers can gain access without valid credentials and obtain root privileges.
- The NCSC says the reported attackers accessed root and placed a Monero cryptocurrency miner; it did not provide attack dates or the number of affected systems.
- Apple released fixes in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9.
- If updates are not immediately possible, users can disable Screen Sharing when it is not needed.
- The NCSC said it had not shared whether the reported attacks extended beyond cryptocurrency mining.
Article Details
- Vulnerability Types
- Authentication bypass
- Exploitation Status
- active
- Exploit Availability
- public_exploit
- Patch Status
- available
- Workarounds
- Disable Screen Sharing in System Settings if it is not needed.
MITRE ATT&CK
CVE
Vendors
Products
macOSThe Netherlands’ National Cyber Security Centre says CVE-2026-65400 in macOS Screen Sharing is being actively exploited after public exploit code appeared.Screen SharingThe Netherlands’ National Cyber Security Centre says CVE-2026-65400 in macOS Screen Sharing is being actively exploited after public exploit code appeared.