The Netherlands National Cyber Security Centre (NCSC) has issued a warning regarding active exploitation of a macOS authentication bypass vulnerability, identified as CVE-2026-65400. This vulnerability affects macOS Screen Sharing, a built-in feature that enables remote desktop control via the VNC protocol on TCP port 5900.
Apple addressed CVE-2026-65400 on August 6, 2026, with fixes included in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9. The flaw allowed network-based attackers to gain unauthorized access without valid credentials, potentially enabling them to remotely open applications, access files, modify security settings, and perform other actions. The update specifically improved state management to ensure proper credential validation and prevent unauthorized authentication attempts.
The NCSC's advisory was updated after the agency received reports of the vulnerability being exploited in the wild. These attacks specifically target systems where port 5900 is exposed to the internet. In the observed incidents, attackers successfully obtained root access to the compromised systems and subsequently deployed a Monero cryptocurrency miner. The NCSC did not provide details on the start date of these attacks, their full scope beyond cryptocurrency mining, or the total number of affected systems.
Users are strongly advised to update their macOS systems to one of the patched versions. For those unable to update immediately, the NCSC recommends disabling Screen Sharing through System Settings (General > Sharing > Screen Sharing) if the feature is not essential.
