macOS Screen Sharing Flaw Now Under Active Attack

A Screen Sharing vulnerability Apple patched earlier this month is already being actively exploited, according to the Netherlands National Cyber Security Centrum (NCSC). The agency said it had received a notification indicating that active abuse of the flaw had been observed on multiple systems where port 5900 was accessible from the internet. In each case, attackers gained root access and installed a Monero crypto miner on the affected system.



Apple fixed the vulnerability in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9. Tracked as CVE-2026-65400, it carries a CVSS severity score of 7.1. Apple said the flaw stemmed from improper authentication in the feature, allowing an attacker on the network to authenticate without valid credentials, view a user's screen, and control the keyboard and mouse. Apple addressed the issue with improved state management.


When Screen Sharing is enabled, port 5900 may be accessible from the internet, leaving unpatched systems especially vulnerable. The NCSC also noted that public proof-of-concept code is available and that active exploitation is known. Public details of the vulnerability emerged during last week's Black Hat security conference, according to Ars Technica.

Anyone running macOS Sonoma, Sequoia, or Tahoe who has not yet updated should install the latest security patches immediately. The feature should remain disabled unless it is actively needed, and users who require remote access over the internet should consider using a VPN.

Mac owners can download the updates over the air by opening System Settings > General > Software Update. For those who prefer a manual installation or need an installer or restore file, direct download links are available on our dedicated pages for macOS Tahoe, macOS Sequoia, and macOS Sonoma. You can also quickly locate the exact firmware file for your specific Mac using the iClarified IPSW Wizard.