The CVE-2026-65400 macOS Screen Sharing vulnerability has been escalated to 9.8 critical severity by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) following active exploitation reports. CISA initially scored the flaw at 7.1 out of 10 on August 6, but raised it to 9.8 critical on August 14 after confirming active attacks. The agency replaced its original vector that assumed attackers needed low-level privileges with one requiring no privileges and granting full compromise of confidentiality, integrity, and availability. The flaw is now assessed as automatable, consistent with unattended Macs being rooted at scale for cryptocurrency mining operations.
The Dutch National Cyber Security Centre (NCSC-NL) updated its advisory on August 12 to confirm active exploitation of CVE-2026-65400 on multiple systems with port 5900 exposed to the internet. In every reported case, attackers obtained root access and installed a Monero miner. The NCSC-NL's August 12 revision added that public proof-of-concept code is now available and active abuse had been observed on multiple internet-exposed systems. Technical details of the bug were presented at last week's Black Hat conference, according to Ars Technica, alongside a video demonstration of the exploit in action. The flaw affects the Secure Remote Password authentication process used by macOS Screen Sharing, with an attacker able to cause the service to treat an unauthenticated connection as authenticated and obtain privileged access. According to the NCSC's advisory, every confirmed case followed the same pattern: attackers gained root access to the system, then placed a Monero crypto miner on the machine.
Huntress researcher Ryan Dowd said a Censys search identified tens of thousands of potentially vulnerable hosts. The risk is particularly relevant to hosted bare-metal Macs, including Mac minis rented for remote workloads, where some hosting environments expose Screen Sharing services on newly provisioned machines. Because exploitation occurs before normal authentication, changing a Screen Sharing password, disabling legacy VNC authentication or removing authorized user accounts does not address the vulnerability. The recommended fix is installing Apple's latest security update or disabling Screen Sharing until the system can be patched. Security practitioners recommend keeping Screen Sharing off unless it's actively needed, and switching it off again once a session ends through System Settings under General, then Sharing. For those who need remote access, connecting through a VPN or SSH tunnel instead of exposing port 5900 directly to the internet is considered safer, though that approach requires technical steps that fall outside what most everyday users are equipped to configure.
The Dutch cases involved cryptojacking rather than theft of wallet credentials, with attackers using the compromised Macs' computing resources to mine Monero after obtaining root control. According to reports from the Netherlands' National Cyber Security Centre, the NCSC has not disclosed the mining software, pool addresses, attacker wallets or resulting XMR proceeds. Monero (XMR) is currently producing about 432 XMR per day, worth roughly $179,000 at recent prices, making it a major target for cryptojacking attacks. Monero mining malware quietly hijacks a computer's processing power to generate cryptocurrency for the attacker, often without any obvious symptoms beyond a sluggish machine and a spike in electricity use. The NCSC hasn't disclosed how many systems have been hit, when the attacks began, or whether the exploitation extends beyond cryptomining, leaving open the possibility that some compromised Macs are dealing with more than just a hidden miner running in the background.
Apple has already shipped a fix for the vulnerability, which is the single most effective way to close off this attack path. The company released updates last week that improve the state management mechanisms behind Screen Sharing, enforcing proper credential validation and blocking the rogue authentication attempts that made the exploit possible. The fix landed in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9. Anyone running an older build of these three macOS releases remains exposed to the vulnerability until they update. The flaw is a bug in macOS screen sharing state management that allows remote attackers to execute malicious code without credentials, with the root cause tracing back to how macOS handles internal bookkeeping that tracks prior events, user interactions, and system variables. Port 5900 is the network channel that VNC-based screen sharing uses to communicate, and when a Mac user turns Screen Sharing on, the built-in macOS firewall automatically opens that port. Most home routers and dedicated firewalls block port 5900 by default, but if a network has been configured to allow it through — intentionally or otherwise — the machine becomes reachable from anywhere on the internet.
