Apple released security updates for macOS Tahoe, Sequoia, and Sonoma on 6 August 2026 to patch a vulnerability in Screen Sharing that could let a network-adjacent attacker authenticate without valid credentials. The affected versions are macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9, all listed on Apple's security releases page under the same date. The Screen Sharing flaw is the only documented issue addressed in this round.

According to Apple's own advisory language, the vulnerability permitted an attacker on the local network to authenticate to Screen Sharing without supplying legitimate credentials. The nature of the component — a remote management service that, when enabled, exposes a graphical session over the network — means that an authentication bypass of this kind effectively grants an attacker interactive desktop access to any affected machine where Screen Sharing is turned on. Apple's security content pages for each release (Tahoe 26.6.1, Sequoia 15.7.9, Sonoma 14.8.9) are live on the company's support site.

Notably, these updates did not pass through Apple's usual developer and public beta channels. The company went straight to a general release, a path it reserves for security issues it considers urgent enough to forgo the standard testing pipeline (Engadget).

This out-of-band cycle lands just over a week after Apple's broader July 2026 security update, which shipped on 27 July and addressed 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6 (ZDI). That earlier round patched macOS down to versions .8 in the Sequoia and Sonoma lines; this new push moves the same two older generations to .9, alongside a fresh Tahoe point release at 26.6.1, a single-patch increment over the July Tahoe build.

The decision to patch across three macOS generations — Tahoe (the current major release), Sequoia (the prior generation), and Sonoma (two generations back) — follows Apple's established pattern of providing security updates for multiple major versions concurrently. Administrators running mixed fleets should note that all three lines received the fix on the same day, though the build numbers differ: Tahoe 26.6.1, Sequoia 15.7.9, Sonoma 14.8.9.

Worth flagging is the bypass itself. An unauthenticated remote access path into Screen Sharing is a high-severity primitive for any deployment where the service is enabled — and in enterprise and education Mac fleets, Screen Sharing is frequently turned on for remote support and management. The attack surface is the local network, which narrows the threat model somewhat: the attacker needs network adjacency rather than arbitrary internet reachability. But "on the network" encompasses any compromised host on the same segment, a guest Wi-Fi bridge onto a corporate VLAN, or a pivot through an already-breached device. In a flat network without segmentation, that surface can extend quite far.

The absence of a beta cycle adds a practical wrinkle for IT teams. Apple's beta program gives administrators a window to test compatibility before general availability. Without that window, the usual MDM-guided deployment — staged pilot, validation, then fleet-wide push — gets compressed. The single-patch scope helps here: rather than validating a broad CVE sweep, teams need only confirm that the Screen Sharing component update does not disrupt existing remote management workflows. Still, deploying without pre-validation carries its own risk, and organizations that depend on Screen Sharing for help-desk operations will want to test that the service still authenticates correctly under the patched version before a full rollout.

The fact that Apple shipped this outside its normal cadence, ten days after a substantial 210-CVE cycle, tells us the company treated the Screen Sharing bypass as time-sensitive enough to bypass its release engineering norms. We do not have a CVE identifier, exploit-in-the-wild confirmation, or attribution from the verified sources. What we do have is a patch for an authentication bypass in a networked remote access component, released with minimal preamble across three supported macOS generations.

For administrators, the guidance is straightforward: identify all Macs running Tahoe, Sequoia, or Sonoma with Screen Sharing enabled, prioritize those on shared or low-trust network segments, and deploy 26.6.1, 15.7.9, or 14.8.9 respectively. Given the vulnerability class, this is one to patch quickly rather than on the next routine cycle.