CVE-2026-65400

What is macOS Screen Sharing?

Screen Sharing is the remote desktop service built into macOS, implemented by the screensharingd system daemon. It speaks the RFB (Remote Framebuffer) protocol used by VNC clients and listens on TCP 5900. Administrators enable it from System Settings → General → Sharing, and it is commonly turned on for remote support of Macs and for headless Mac minis used as build machines or media servers.

Screen Sharing is not enabled by default, which bounds the vulnerable population. But where it is enabled, the daemon runs with root privileges and processes authentication traffic before any credential has been verified — so a flaw in that path hands an attacker a root-level foothold on a machine that is, by the nature of the service, reachable over the network.

Overview

CVE-2026-65400 is an improper authentication flaw (CWE-287) in the Screen Sharing daemon that lets a network attacker authenticate without any valid credentials. CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H).

Apple shipped fixes on 2026-08-06. On 2026-08-12 the Dutch National Cyber Security Centre (NCSC-NL) reported active exploitation against Macs with port 5900 exposed to the internet, and in every reported case the attackers obtained root access and installed a Monero cryptocurrency miner. CISA added the CVE to KEV on 2026-08-18 with a 2026-08-21 deadline.

Affected Versions

Apple documented the fixes in support articles 148170, 148171, and 148172.

Technical Details

The defect is in screensharingd's implementation of Secure Remote Password (SRP) authentication. An error in the service's frame-length validation causes it to return a stale success status — so the daemon treats a connection that never completed authentication as authenticated.

Two consequences follow:

• Authentication is bypassed entirely. No password, no key, no user interaction. Network reachability to TCP 5900 is the only requirement.
• The session is cleartext. Because the SRP exchange never actually completed, the connection proceeds without the cryptographic protection it would normally establish.

From bypass to root code execution. Researchers demonstrated full RCE by abusing the SSFileCopySender helper process, which holds Full Disk Access and bypasses TCC protections entirely — turning the authentication bypass into arbitrary file access and code execution as root, outside macOS's privacy controls.

Credential hardening does not help. Because the flaw sits before authentication, the usual VNC-hardening steps have no mitigating effect: removing allowed user accounts, disabling legacy VNC password authentication, and rotating the VNC password all leave the bypass fully exploitable. Patching or disabling the service are the only real options.

Not to be confused with CVE-2026-43760. Disclosed days apart and also affecting Screen Sharing, CVE-2026-43760 (reported by bynar.io) is a confused-deputy condition that requires prior authentication via legacy VNC. CVE-2026-65400 requires none, which is what makes it substantially more dangerous.

Discovery

Pedro Vilaça (fG!) initially disclosed the pre-authentication bug, publishing an obfuscated proof-of-concept. Researcher bl4sty subsequently reverse-engineered that PoC and demonstrated remote code execution via the SSFileCopySender helper. Huntress published detection guidance built on Endpoint Security telemetry.

Exploitation Context

NCSC-NL's 2026-08-12 advisory documented in-the-wild attacks against internet-exposed Macs. The observed pattern was consistent: attackers reached port 5900, bypassed authentication, obtained root, and deployed a Monero (XMR) cryptominer. Cryptojacking is the confirmed objective in reported cases — but the same primitive yields root, so any exposed host should be treated as fully compromised rather than merely mining on someone else's behalf.

Detection indicators from Huntress's Endpoint Security analysis:

• Screen Sharing sessions recording authentication_type: SRP without corresponding RSA encryption.
• Sessions with session_username: root.
• Execution of /System/Library/CoreServices/RemoteManagement/screensharingd.bundle/Contents/Support/SSFileCopySender.bundle/Contents/MacOS/SSFileCopySender with UID 0, GID 80.

Remediation

1. Update to macOS 26.6.1, 15.7.9, or 14.8.9. This is the only fix for the underlying flaw.
2. Disable Screen Sharing where it is not required (System Settings → General → Sharing). Given that the service is off by default, any host with it enabled should have a specific reason.
3. Never expose TCP 5900 to the internet. Require a VPN or an authenticated jump host for remote access. This is the control that separated victims from non-victims in the observed campaign.
4. Do not rely on credential hardening. Rotating the VNC password, removing allowed users, or disabling legacy VNC auth do not mitigate this bug — a common and dangerous assumption for a service whose other CVEs are credential-related.
5. Hunt for the indicators above — SRP sessions without RSA, root sessions, and SSFileCopySender executing as UID 0.
6. Check for cryptominer persistence on any host that was exposed: unexpected LaunchDaemons and LaunchAgents, sustained high CPU, XMRig-family processes, and outbound connections to mining pools.
7. If compromised, rebuild. Root was obtained with TCC bypassed, so treat all local secrets, keychains, and SSH keys on the host as disclosed and rotate them.