Vulnerability giving attackers full control of Macs is under active exploitation
CVE-2026-65400 is a high-severity (7.1/10) macOS vulnerability in the screen sharing feature that allows unauthenticated remote code execution with root privileges The Netherlands NCSC confirms active exploitation targeting systems with port 5900 exposed to the Internet, resulting in Monero crypto miner deployment Apple released patches for macOS Tahoe, Sequoia, and Sonoma following public disclosure at Black Hat security conference The root cause is a flaw in state management within macOS scree
Analysis
TL;DR
- CVE-2026-65400 is a high-severity (7.1/10) macOS vulnerability in the screen sharing feature that allows unauthenticated remote code execution with root privileges
- The Netherlands NCSC confirms active exploitation targeting systems with port 5900 exposed to the Internet, resulting in Monero crypto miner deployment
- Apple released patches for macOS Tahoe, Sequoia, and Sonoma following public disclosure at Black Hat security conference
- The root cause is a flaw in state management within macOS screen sharing, which tracks system events, user interactions, and variables
- Security experts recommend keeping screen sharing disabled when not in use and avoiding direct port 5900 exposure, favoring VPN or SSH tunneling instead
Why It Matters
This vulnerability is significant because it affects a widely used macOS feature and requires no credentials to exploit, making it attractive to opportunistic attackers scanning the internet. The active exploitation in the wild demonstrates the real-world urgency of patching and proper network configuration for Mac users, especially in enterprise environments where screen sharing may be enabled for remote support.
Technical Details
- CVE-2026-65400: Severity rating 7.1/10; affects macOS screen sharing functionality across Tahoe, Sequoia, and Sonoma; patched by Apple following Black Hat disclosure
- Attack vector: Port 5900 (VNC default) must be accessible from the Internet; the macOS firewall opens this port when screen sharing is enabled
- Exploitation mechanism: A state management bug allows unauthenticated attackers to gain root access by manipulating preceding events, user interactions, and system state variables
- Observed impact: All confirmed exploits so far result in root-level access and deployment of Monero cryptocurrency miners
- Mitigation: Install Apple's security update; disable screen sharing when not needed via System Settings > General > Sharing; avoid exposing port 5900 directly; use VPN or SSH tunneling for remote access
Industry Insight
- Organizations should audit macOS deployments for exposed port 5900 and enforce screen sharing policies that require VPN or SSH tunneling rather than direct internet access
- The pattern of crypto miner deployment suggests this vulnerability is currently being exploited for low-effort profit, but the unauthenticated root access makes it a prime candidate for more sophisticated malware delivery in the future
- Apple's use of hedging language ("may allow") in its security advisory highlights the ongoing tension between transparency and responsible disclosure, reinforcing the need for practitioners to treat all unpatched vulnerabilities as actively exploitable until confirmed otherwise
Disclaimer: The above content is generated by AI and is for reference only.