macOS Screen Sharing Flaw Under Active Exploitation: What You Need to Know
A previously patched macOS Screen Sharing vulnerability is now under active exploitation, with confirmed incidents in the Netherlands where attackers gained root access — the highest level of system privilege — and installed cryptocurrency mining software on compromised machines. The Netherlands National Cyber Security Centrum (NCSC-NL) issued advisory NCSC-2026-0280 on August 12, 2026, reporting that it had received notifications of the vulnerability being exploited on multiple systems. (NCSC-NL)
The flaw, tracked as CVE-2026-65400, allows an attacker on the same network to authenticate to Screen Sharing without valid credentials. Once connected, the attacker can view the user's screen, open files, and perform nearly any action as if they had physical possession of the machine. (Apple Support)
Apple addressed the vulnerability in out-of-band security updates — meaning patches released outside the normal update schedule — on August 6, 2026. The company released macOS 26.6.1 for Tahoe, 15.7.9 for Sequoia, and 14.8.9 for Sonoma, all dated August 6. (TidBITS) The patches preceded the NCSC-NL advisory by roughly six days, meaning the fixes were available before in-the-wild exploitation was publicly confirmed. (Engadget)
CISA (the U.S. Cybersecurity and Infrastructure Security Agency) subsequently rescored CVE-2026-65400 from a CVSS base score of 7.1 to 9.8 (critical) eight days after Apple's patch was released. CVSS, or Common Vulnerability Scoring System, is an industry-standard scale from 0 to 10 that rates how severe a software flaw is. The original 7.1 rating would have placed it in the "high" band; the upward revision to 9.8 places it at the top of the scale. (Tom's Hardware)
In every reported exploitation case, attackers achieved root access and uploaded crypto mining software, specifically a Monero miner. (Engadget) The choice of payload points to a financially motivated, opportunistic attack rather than targeted espionage. Monero's privacy features make it the cryptocurrency of choice for cryptojacking — the unauthorized use of someone else's computer to mine cryptocurrency — and macOS machines, often left running for extended periods, present attractive mining targets when root access is obtainable.
The attack surface is narrow but consequential. Exploitation requires port 5900, the standard VNC/Screen Sharing port, to be exposed to the internet. VNC (Virtual Network Computing) is the protocol that Screen Sharing uses to transmit screen images and accept input over a network. Security experts recommend keeping that port closed, especially while screen sharing is active. Users can also disable Apple's Screen Sharing tool entirely through the macOS System Settings menu as a defensive measure. (Engadget)
For Mac administrators, the practical takeaway is straightforward: apply the relevant macOS update, ensure port 5900 is not exposed externally, and disable Screen Sharing if it is not needed. The patch set covers three major macOS releases, which is notable; Apple's decision to backport fixes to Sonoma (14.x) indicates the company assessed the risk as significant enough to warrant coverage of an older release branch.
A parallel screen-sharing vulnerability surfaced in the same period at Zoom, where a bug allowed participants on a call to fully take over other devices. Zoom has issued a patch. (Engadget) The coincidence of two independent screen-sharing flaws surfacing within the same window is worth noting for security teams evaluating remote-access tooling, though there is no indication the vulnerabilities are related.
The timeline here matters. Apple shipped the fix on August 6. NCSC-NL confirmed active exploitation on August 12. CISA rescored to critical severity on August 14, the same day Ars Technica published its report. The gap between patch availability and confirmed exploitation suggests either delayed patch adoption in the affected Netherlands systems or that the vulnerability was being exploited before NCSC-NL's advisory and the public reporting caught up. The verified facts do not establish which scenario occurred.
The broader context here is that this is not the first time a remote-access protocol has become an attack vector of opportunity, and it will not be the last. Screen sharing and remote desktop services are functionally designed to grant exactly the kind of access an attacker wants: interactive control of a machine, often with elevated privileges. When authentication can be bypassed, the result is effectively unauthenticated remote code execution with a graphical session attached. The macOS Screen Sharing implementation, using VNC on port 5900, is no different in structural risk from any other VNC-based remote desktop exposure. What makes this incident notable is the authentication bypass itself, not the underlying protocol choice.
For organizations running macOS fleets, the action items are bounded and immediate: patch to 26.6.1, 15.7.9, or 14.8.9 depending on the OS generation; audit firewall and network exposure rules for port 5900; and disable Screen Sharing on endpoints where it is not operationally required. The NCSC-NL advisory and CISA's rescoring both signal that this is not a theoretical risk. It is being used, and the payload is already running on compromised machines.
