Hackers are actively exploiting a recently patched vulnerability in macOS Screen Sharing to gain root access on compromised systems and deploy Monero cryptocurrency miners. The Dutch National Cyber Security Centre (NCSC-NL) has confirmed reports of this exploitation, noting that affected systems typically have port 5900, used by Screen Sharing, exposed to the internet.
The flaw, identified as CVE-2026-65400, carries a CVSS score of 9.8, indicating its critical severity. It is an authentication bypass vulnerability within macOS's built-in remote desktop tool, Screen Sharing. Apple addressed this issue less than two weeks prior to the confirmed exploitation, releasing patches in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9. The company credited Alfredo Pesoli (@__rev) of Bynario Atlas for discovering the vulnerability.
According to Apple's advisory, the bug allowed an attacker on the network to authenticate to Screen Sharing without valid credentials due to insufficient state management during the authentication process. This allowed unauthorized individuals to bypass the normal authentication procedure.
The NCSC-NL's advisory confirms that in all observed cases of exploitation, attackers successfully obtained root access on the target systems and subsequently installed a Monero crypto miner. While gaining root access on a Mac presents a wide range of potential malicious activities, the deployment of a cryptocurrency miner suggests opportunistic scanning rather than highly targeted attacks.
This vulnerability shares the same source code file as two other Screen Sharing bugs that Apple patched approximately a month earlier in macOS 26.6. One of these earlier flaws was described by a researcher known as @osxreverser as a pre-authentication vulnerability requiring only a target's IP address for exploitation, with no username or password needed. That researcher claimed to have identified around 40,000 exposed Screen Sharing hosts during an internet scan, with nearly half located in the United States, including residential, university, and some corporate networks.
Security firm Calif, which analyzed both the earlier and current Screen Sharing flaws, noted their mechanical simplicity. The vulnerabilities were not attributed to memory corruption, complex exploitation techniques, or race conditions, but rather to logic errors that allowed specific sequences of packets to bypass authentication. Calif also reported developing a working exploit for both vulnerabilities in approximately four hours using an AI coding agent, highlighting the shrinking time frame between vulnerability disclosure and the availability of functional exploits.
Users with Screen Sharing enabled on their Macs are strongly advised to update their operating systems immediately to the patched versions. If an immediate update is not feasible, disabling Screen Sharing entirely under System Settings > General > Sharing is recommended to prevent potential compromise. Leaving port 5900 open to the internet without the patch is considered a significant security risk.
