Critical macOS Screen Sharing Vulnerability Under Active Exploitation

August 14, 2026 Rachel Kim – Technology Editor Technology

Vulnerability Giving Attackers Full Control of Macs Is Under Active Exploitation

Dutch officials warned earlier this week that a high-severity macOS vulnerability allowing remote attackers to execute arbitrary code is currently under active exploitation in real-world environments. Tracked as CVE-2026-65400 and carrying a severity rating of 7.1 out of 10, the flaw targets core architecture within macOS screen-sharing capabilities. According to the Netherlands National Cyber Security Centrum (NCSC), attackers have successfully targeted systems leaving port 5900 open to the internet.

The Tech TL;DR:

  • The Threat: A state-management flaw in macOS screen sharing allows unauthenticated remote code execution and full root access when port 5900 is exposed.
  • The Real-World Impact: Threat actors are actively scanning the internet, compromising exposed endpoints, and deploying Monero cryptocurrency miners.
  • The Mitigation: Apple issued patches last week for macOS Tahoe, Sequoia, and Sonoma.

Anatomy of the CVE-2026-65400 Exploit Vector

The security defect stems from improper state management within the macOS screen-sharing daemon. This subsystem manages incoming virtual network computing (VNC) connections, tracking preceding events, user interactions, and active system variables. When a machine is powered on and network sockets accept connections on port 5900, the vulnerable state machine fails to sanitize incoming packet sequences properly.

Per warnings issued by the Netherlands National Cyber Security Centrum, the active abuse observed across multiple victim networks follows a distinct post-exploitation pattern. Once malicious payloads pierce the state verification layer, attackers achieve full root privileges. From there, unauthorized administrative access is leveraged to drop resource-intensive background processes, specifically Monero crypto miners, which degrade host CPU and GPU performance.

# Check if port 5900 is actively listening and exposed locally
sudo lsof -i -P -n | grep 5900

# Inspect active VNC screen sharing service status via launchctl
sudo launchctl list | grep com.apple.screensharing

Patch Availability and Enterprise Mitigation Strategies

Apple addressed the core vulnerability in software updates released last week across multiple operating system iterations, including macOS Tahoe, Sequoia, and Sonoma.

Defending Distributed Mac Fleets

Frequently Asked Questions

What causes the CVE-2026-65400 vulnerability in macOS?

The vulnerability stems from a state-management flaw in the macOS screen sharing capability, which tracks preceding events and system variables when processing remote connections on port 5900.

Which macOS versions are affected by this flaw?

Apple has released patches for macOS Tahoe, Sequoia, and Sonoma to remediate the vulnerability, which carries a severity rating of 7.1 out of 10.

*Disclaimer: The technical analyses and security protocols detailed in this article are for informational purposes only. Always consult with certified IT and cybersecurity professionals before altering enterprise networks or handling sensitive data.*

More on this