← News
/DISPATCH · 2026-08-15

CVE-2026-65400: macOS Screen Sharing Auth Bypass Exploited in the Wild; Attackers Drop Monero Miner, Gain root

NCSC-NL updated its alert on 13 Aug. CVE-2026-65400 (CVSS 7.1), a macOS Screen Sharing authentication bypass, is exploited in the wild. Attackers need no credentials, obtain root, and implant a Monero cryptominer.

CVE-2026-65400 is an authentication bypass in the macOS Screen Sharing component, CVSS 7.1. Apple patched it on 6 Aug via macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. NCSC-NL updated its warning on 13 Aug after multiple reports: attackers exploit the flaw on systems with port 5900 exposed, obtain root, and implant a Monero miner.

Incident Overview

Apple shipped macOS security updates on 6 Aug, fixing an authentication defect in Screen Sharing. NCSC-NL first published an advisory on 7 Aug (vulnerability description only) and on 13 Aug raised the threat level to active exploitation observed. NCSC-NL: the CVE-2026-65400 fixes are macOS Sequoia 15.7.9, Sonoma 14.8.9, and Tahoe 26.6.1. An attacker with network reach to port 5900 (Screen Sharing default VNC port) bypasses authentication, obtains root, and deploys a Monero miner on the host. In every case reported to NCSC-NL, the attacker obtained root on the affected system.

Technical Details

Screen Sharing provides remote desktop over VNC on TCP 5900. CVE-2026-65400 is a state-management defect: the authentication path does not adequately validate client-supplied credentials. An attacker obtains a session without a valid username or password.

Two preconditions for exploitation:

NCSC-NL: once root is obtained, operators implant a Monero miner and occupy compute long-term. Sustained high CPU makes the dwell window noisier than classic ransomware if exposure lasts.

Apple's fix hardens state management and forces correct credential validation, blocking illicit auth attempts. The bug spans Sequoia, Sonoma, and Tahoe — nearly every in-use macOS device. In China, large numbers of macOS workstations are used for development, design, and cross-border office work. Developers who enable Screen Sharing and expose it to the public internet face a high probability of scan-and-exploit.

Impact Assessment

CVE-2026-65400 combines three high-risk factors: unauthenticated, network-reachable, root on land. NCSC-NL reports root in every case — in-the-wild success rate is high. Operators monetize via mining, not ransomware: a low-intensity, long-dwell model. Monero mining demands covert hashpower; it spikes CPU, cuts battery life, raises thermals, degrades UX, and raises detection risk. CVSS 7.1 looks moderate. Stacked with 5900 exposure and NCSC-NL's observed success rate, treat it as a high-priority patch.

Remediation

References