panchocosil/CVE-2026-65400-poc

Reported Context (1)

panchocosil/CVE-2026-65400-poc — read-only Python PoC. It connects to TCP/5900, performs the RFB/SRP handshake, triggers the pre-auth bypass, and reads root-only files such as /etc/sudoers, /etc/passwd, and CVE-2026-65400: macOS Screen Sharing Authentication Bypass Reported Under Active Exploitation

CVE (1)

Malware (1)

People (2)

MITRE ATT&CK (4)

Vendors (1)

Products (2)

Tools (7)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.