LIVE · cybersecurity feed
Live wire
ASOS Breach Reveals the Risks in Customer-Facing SaaSUnpatched AhsayCBS flaws exploited to deploy webshells, mine cryptoAI Training Critical as Governance Challenges GrowUS Disrupts Chinese State-Sponsored Hacking ToolsCitrix warns admins to patch new NetScaler RCE flaw immediatelyCisco Patches a Dozen Critical VulnerabilitiesCisco warns of critical flaws allowing Nexus switch takeoverCVE-2026-21589 · Exploitation attempts against critical Atlassian flaw have begun (CVE-2026-21589)Cyber experts call on CISA to create mandatory federal OT rulesGremlin Foresight AI finds system weaknesses and verifies the fixes
cve recordcriticalexploited in the wild3 of 3 cataloguesexploit reported

CVE-2026-65400

Apple · macOS · Apple macOS Improper Authentication Vulnerability

Published · Added to CISA KEV
CVSS9.8
Severitycritical
WeaknessCWE-287
EPSS1.7%77.3th percentile
Exploited3 KEV sources
Ransomware useUnknown
Federal fix dueAug 21, 2026

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

patch window

Called exploited 1 day after disclosure.

Measured from the CVE publication date to the earliest of 3 KEV catalogues that list it.

The life of this vulnerability

  1. CVE published
  2. First KEV listing1d
  3. Last KEV listing11d
  4. Last sighting16d

Gaps are compressed to equal steps. The elapsed time is printed under each.

Which catalogues call it exploited

Sources3 of 3
Listings differ by11 d
Strongest claimconfirmed

3 catalogues list it. CIRCL aggregates the others and is shown but not counted.

Public exploitation evidence

7 public reports collected from VulnCheck and CIRCL, first on Aug 7, 2026. Each links to its original source. We have not verified them.

Description

An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.

Required action (CISA)

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

References

← Back to the CVE Tracker

Our coverage of CVE-2026-65400

CVE-2026-65400critical

Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert regarding four critical vulnerabilities that are reportedly under active exploitation. These flaws affect Apple macOS, Microsoft SharePoint, VMware vCenter Server, and Microsoft Internet Key Exchange (IKE). CISA has added these vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, indicating…

CVE-2026-68820high

17th August – Threat Intelligence Report

Several organizations across various sectors have recently reported cyberattacks and data breaches, while security researchers have detailed new vulnerabilities and emerging threat trends, including the use of AI in cyberespionage.

CVE-2026-65400critical

macOS Screen Sharing Flaw Exploited to Deploy Monero Miners

Hackers are actively exploiting a recently patched vulnerability in macOS Screen Sharing to gain root access on compromised systems and deploy Monero cryptocurrency miners. The Dutch National Cyber Security Centre (NCSC-NL) has confirmed reports of this exploitation, noting that affected systems typically have port 5900, used by Screen Sharing, exposed to the internet.