MacOS Screen Sharing Flaw CVE-2026-65400 Under Active Attack
The flaw allows full system compromise without credentials, and active exploits are already installing cryptocurrency miners, making the emergency patch essential for all Mac users.
Reporting from 1 source: GIGAZINE.
The Dutch Cyber Security Centre reports that CVE-2026-65400, an authentication flaw in macOS Screen Sharing, is being actively exploited. Attackers can log into any account without a password and gain root access, then install a Monero miner. Apple issued an emergency patch on August 6, 2026.
The Dutch Cyber Security Centre (NCSC-NL) disclosed that CVE-2026-65400 stems from insufficient state management in the authentication process, letting attackers make authentication attempts that normally require valid credentials. In effect, it allowed logging into any account without knowing the password.
Security researcher Calif published a proof-of-concept video after reverse-engineering Apple's emergency update from August 6, 2026, getting an exploit working in about four hours. According to NCSC-NL, every observed exploitation gained root-level access and installed a Monero miner that secretly uses Mac resources. The miner itself causes limited harm, but the same access could steal credentials or install more damaging malware.
Apple has distributed a patch. NCSC-NL advises turning on Screen Sharing only when needed.
Synthesized by Yomimono from the 1 cited source below, including Japanese-language reporting where cited, then editorially reviewed before publishing.
Sources
- GIGAZINE macOSの画面共有関連の脆弱性を悪用した深刻度の高い攻撃が頻発している