Apple patched a critical macOS Screen Sharing vulnerability on August 6, and for most sites, that would be the end of the story. It is not. The Netherlands’ national cyber security centre, NCSC-NL, updated its advisory on August 12 to confirm attackers are actively exploiting the flaw against Macs left reachable from the open internet, and coverage this week shows those attacks ending with a Monero cryptocurrency miner running as root. If you or anyone on your team has Screen Sharing turned on, this is worth five minutes today.
What CVE-2026-65400 actually does
The bug lives in screensharingd, the system daemon behind macOS’s built-in remote desktop feature. Screen Sharing normally authenticates a connection using Secure Remote Password, a challenge-response scheme that is supposed to reject anyone who does not know the account password. According to the technical breakdown published by Apple and cross-referenced by security researchers, the daemon’s frame-length validator returned a stale success status under certain conditions, so the connection got waved through as authenticated even when it was not, and the session then continued in cleartext with no encryption. An attacker on the network, or anyone who could reach port 5900, could get in without ever knowing a password.
Apple credits Alfredo Pesoli of Bynario Atlas with the discovery and rates the issue critical, with third-party trackers scoring it at CVSS 9.8. Apple’s own advisory describes it more plainly: “an authentication issue was addressed with improved state management.”
Who is actually at risk
Exploitation requires two things to line up: Screen Sharing has to be turned on, and port 5900 has to be reachable from outside your local network. That second part is the one that matters most. NCSC-NL’s advisory is specific that the exploitation it observed hit systems with the port exposed directly to the internet, not machines sitting safely behind a home or office router with no port forwarding rules. Once an attacker got in, they gained root and dropped a Monero miner, according to the agency’s writeup.
What to do about it
- Update to macOS Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9 (or whatever is current when you read this). Apple shipped the fix for all three branches on August 6.
- If nobody outside your network needs to reach Screen Sharing, turn it off in System Settings under General, then Sharing.
- Never forward port 5900 straight to the internet. If you genuinely need remote screen access, put it behind a VPN or an SSH tunnel instead.
- If your Mac was internet-facing before you patched, open Activity Monitor and look for an unfamiliar process eating CPU. That is the tell for the miner payload NCSC-NL described.
None of this requires specialized tools, just five minutes in System Settings and a software update. Given that public proof-of-concept code is already circulating and NCSC-NL is still tracking active abuse, that five minutes is worth spending today rather than next week.
It has been a busy month for critical patches across the board. Earlier in August, WordPress shipped its own fix for a real remote code execution vulnerability in core. If you want the running list of what has shipped and what is still exploitable, we track it in our News & Updates coverage.
