macOS Screen Sharing CVE-2026-65400: exploited for root
A pre-auth flaw in macOS screensharingd gives attackers root on any Mac with port 5900 exposed. Dutch NCSC confirmed active exploitation. Patch or disable it.
If your team runs Macs and anyone ever turned on Screen Sharing to help a colleague, read this one. CVE-2026-65400 is a pre-authentication flaw in macOS Screen Sharing that hands an attacker root. The Netherlands' National Cyber Security Centre confirmed active exploitation on August 14, and in every case it confirmed, the machine ended up running a Monero miner.
What actually happened
The bug is in screensharingd, the daemon behind macOS's built-in remote desktop. Per Huntress's technical breakdown, the daemon's Secure Remote Password implementation has a frame-length validator that returns a stale success status — so the connection gets treated as authenticated and proceeds in cleartext. From there, a helper process (SSFileCopySender) that inherits Full Disk Access entitlements lets an attacker read and write arbitrary files as root, bypassing TCC. Root shell via a LaunchDaemon or a modified shell startup file.
The sequence matters. Pedro Vilaça confirmed the pre-auth bug on July 29. A working RCE proof of concept existed by August 2. Apple patched on August 6 in macOS 26.6.1, 15.7.9 and 14.8.9. Exploitation in the wild was confirmed eight days after that, per BleepingComputer, against systems with TCP port 5900 reachable from the internet. NCSC advisory 2026-0280 has the details.
Why this macOS Screen Sharing flaw matters for your business
VNC password rotation does nothing. This is the part people get wrong. The bypass happens before authentication is evaluated, so every hardening habit built around the Screen Sharing password is irrelevant here. There are two real controls: the patch, or turning the service off.
Port 5900 exposure is usually an accident. Nobody deliberately publishes a Mac's remote desktop to the internet. It happens through a UPnP mapping on a small-office router, a port forward somebody set up during a 2022 remote-work scramble, or a Mac mini build server sitting in a colo with a public IP. Scan your own external ranges for 5900 today. It takes ten minutes and it is the only answer you can trust.
A cryptominer is the low-consequence outcome. Pre-auth root on a developer's Mac means SSH keys, ~/.aws/credentials, .npmrc tokens, and whatever is in the login Keychain. We covered the same blast radius when ClickFix stealers went after macOS Keychain. Miners are just what the noisy operators deploy. Assume the quiet ones took credentials.
Check the version, not the update badge. Confirm with sw_vers that machines are on 26.6.1, 15.7.9 or 14.8.9 or later. Then turn Screen Sharing off in System Settings → General → Sharing on every Mac that does not need it, which is most of them.
Key takeaways
- CVE-2026-65400 is a pre-authentication flaw in the macOS
screensharingdSRP implementation that yields remote code execution as root - Apple patched it on August 6, 2026 in macOS 26.6.1, 15.7.9 and 14.8.9
- Dutch NCSC advisory 2026-0280 confirmed active exploitation on August 14 against hosts with TCP port 5900 internet-exposed; Monero miners were deployed in every confirmed case
- Rotating the VNC password has no effect — the bypass happens before authentication is checked
- A helper with Full Disk Access entitlements means TCC is bypassed, so Keychain, SSH keys and cloud credentials are in scope
- Two controls only: patch, or disable Screen Sharing in System Settings → General → Sharing
Most small teams have no inventory of what their office IP actually exposes. We audit the boring perimeter — open ports, forgotten forwards, stale admin services — and document it so you can answer the question next time in minutes. Ask us what your network is publishing or see how we build systems you can actually inspect.
Sources: Huntress, BleepingComputer.
- #cve-2026-65400
- #macos
- #screen-sharing
- #endpoint-security
- #patch-management
Tommy Rush — Founder, Rush Commerce
Operator turned builder. 15+ years running operations — now shipping the systems businesses run on. More
Get The Rush Report weekly — one email, zero fluff.
Keep reading
Vals AI raises $40M to be the auditor of AI models
a16z led a $40M round for independent AI evaluation. The useful part for operators isn't the funding — it's that benchmarks decay, and yours should too.
Read itManifest V2 ends August 31. Audit your browser extensions.
Chrome pulls all remaining Manifest V2 extensions from its store on August 31, 2026, and Edge started its consumer shutdown. What breaks on your team's machines.
Read it