Threat actors are exploiting a recently patched macOS vulnerability to gain root access and deploy cryptominers.
The exploited bug, tracked as CVE-2026-65400, is a high-severity authentication issue in Screen Sharing that allows remote attackers to log in without valid credentials.
Apple disclosed the flaw on August 6, when it rolled out fixes in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9.
Roughly a week later, the Dutch National Cyber Security Centrum (NCSC) warned that in-the-wild exploitation has started, fueled by the existence of a public proof-of-concept (PoC) exploit.
“The NCSC has received a notification showing that active abuse of this vulnerability has been observed on multiple systems on which port 5900 was accessible from the internet,” NCSC says.
Threat actors have been exploiting the security defect to gain root access to the vulnerable systems and install a Monero miner, it says.
“Apple has improved state management mechanisms to enforce correct validation of login credentials and prevent unauthorized authentication attempts,” NCSC notes.
According to AI security firm Calif, the flaw allows a remote attacker to authenticate to a macOS system that has Screen Sharing enabled by simply naming an account.
“Naming an account is the one thing the bug needs. It is not much of a barrier. A username is not a secret, and macOS prints them on the login window,” Calif notes.
CVE-2026-65400, however, is not the only recently patched vulnerability in screensharingd, the daemon responsible for managing Screen Sharing connections.
In late July, Apple patched at least four other issues in it, including three that have CVE identifiers. Reportedly, the fourth, which was silently addressed, was the most severe of them, as it allowed unauthenticated attackers to gain remote code execution as root.
According to security researcher osxreverser, the issue could be exploited to take over any macOS with Screen Sharing enabled, as long as the attacker knew its IP address and SIP was disabled.
The flaw reportedly did not require user interaction and could allow an attacker to plant a reverse shell and a root crontab through the same connection.
On August 8, osxreverser warned that approximately 40,000 internet-accessible macOS systems had Screen Sharing enabled, meaning that they were potentially exposed to attacks.
Related: Hackers Exploiting Unpatched GeoServer Zero-Day
Related: Adobe Commerce Bug Targeted Immediately After Disclosure
Related: WordPress 7.0.4 Patches Remote Code Execution Vulnerability
Related: Fortinet Patches Authentication Flaws in FortiWeb and FortiManager
