Key Takeaways
- • CVE-2026-65400, a macOS Screen Sharing vulnerability with a 7.1 severity rating, has been actively exploited by threat actors to bypass authentication and gain root-level access to internet-exposed systems since before Apple's August 6, 2026 patch.
- • Monero cryptocurrency miners have been installed on multiple compromised Macs following exploitation, indicating coordinated cryptojacking campaigns targeting systems with port 5900 exposed to the internet.
- • Apple issued emergency patches on August 6, 2026, across three macOS versions (Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9) following disclosure by the Netherlands' National Cyber Security Centre (NCSC-NL).
- • Screen Sharing is not enabled by default on standard Macs but remains active on remotely managed workstations, development systems, and hosted Mac mini/Studio servers, creating enterprise risk exposure for institutional users.
- • Compromised systems require full security review post-patch, as root-level access gained prior to patching suggests attackers may have established persistent backdoors beyond the initial mining payload.
Summary
The Netherlands' National Cyber Security Centre has disclosed active exploitation of a macOS Screen Sharing vulnerability across multiple internet-accessible systems, according to Bitdefender reporting. Tracked as CVE-2026-65400, the flaw allows remote attackers to bypass authentication entirely and access Screen Sharing functionality without credentials. In reported cases, attackers used this access to obtain root-level privileges and deploy Monero cryptocurrency miners, indicating organized cryptojacking operations targeting Mac infrastructure exposed to the internet.
Apple patched the vulnerability on August 6, 2026, releasing emergency updates across three supported macOS versions: Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. The vulnerability carries a severity rating of 7.1 out of 10, reflecting its ease of exploitation and high-impact consequences. Screen Sharing, built on the Remote Framebuffer protocol (VNC standard), ordinarily listens on TCP port 5900 and enables remote users to view, control, and manage a Mac—including opening files, launching applications, and triggering restarts—making it valuable for enterprise remote management but dangerous if exposed without authentication controls.
While Screen Sharing is not enabled by default on consumer Macs, institutional investors and family offices operating managed development environments, remotely administered workstations, or hosted Mac servers face material risk exposure. The exploits demonstrate that attackers are actively scanning for and targeting systems with port 5900 exposed to the internet. Institutional users should prioritize immediate patching across all affected macOS versions, disable Screen Sharing when unnecessary, and treat any system that may have been compromised before patching as fully breached pending forensic review. The timing of exploitation—occurring within days of disclosure—reflects the rapid threat operationalization common in cryptojacking campaigns seeking to monetize access before patches achieve broad adoption.
Apple patched the vulnerability on August 6, 2026, releasing emergency updates across three supported macOS versions: Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. The vulnerability carries a severity rating of 7.1 out of 10, reflecting its ease of exploitation and high-impact consequences. Screen Sharing, built on the Remote Framebuffer protocol (VNC standard), ordinarily listens on TCP port 5900 and enables remote users to view, control, and manage a Mac—including opening files, launching applications, and triggering restarts—making it valuable for enterprise remote management but dangerous if exposed without authentication controls.
While Screen Sharing is not enabled by default on consumer Macs, institutional investors and family offices operating managed development environments, remotely administered workstations, or hosted Mac servers face material risk exposure. The exploits demonstrate that attackers are actively scanning for and targeting systems with port 5900 exposed to the internet. Institutional users should prioritize immediate patching across all affected macOS versions, disable Screen Sharing when unnecessary, and treat any system that may have been compromised before patching as fully breached pending forensic review. The timing of exploitation—occurring within days of disclosure—reflects the rapid threat operationalization common in cryptojacking campaigns seeking to monetize access before patches achieve broad adoption.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.