Apple released security updates for macOS Tahoe, Sequoia, and Sonoma on 6 August 2026 to fix a vulnerability in Screen Sharing that could let an attacker on the same network log in without valid credentials. The affected versions are macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9, all listed on Apple's security releases page under the same date. The Screen Sharing flaw is the only issue addressed in this round.

Screen Sharing is a built-in macOS feature that, when turned on, lets someone view and control a Mac's desktop from another computer over the network. Apple's advisory says the vulnerability allowed an attacker on the local network to authenticate to Screen Sharing without supplying legitimate credentials. In practical terms, that means an attacker could gain interactive desktop access to any affected Mac where Screen Sharing is enabled. Apple's security content pages for each release (Tahoe 26.6.1, Sequoia 15.7.9, Sonoma 14.8.9) are live on the company's support site.

These updates did not pass through Apple's usual developer and public beta channels. The company went straight to a general release, a path it reserves for security issues it considers urgent enough to skip the standard testing pipeline (Engadget).

This out-of-band cycle lands just over a week after Apple's broader July 2026 security update, which shipped on 27 July and addressed 210 unique CVEs (publicly disclosed security flaws, each assigned a tracking number) across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6 (ZDI). That earlier round patched macOS down to versions .8 in the Sequoia and Sonoma lines; this new push moves the same two older generations to .9, alongside a fresh Tahoe point release at 26.6.1, a single-patch increment over the July Tahoe build.

The decision to patch across three macOS generations follows Apple's established pattern of providing security updates for multiple major versions at the same time. Tahoe is the current major release, Sequoia is the prior generation, and Sonoma is two generations back. Administrators running mixed fleets should note that all three lines received the fix on the same day, though the build numbers differ: Tahoe 26.6.1, Sequoia 15.7.9, Sonoma 14.8.9.

The broader context here is what the bypass actually means for affected organizations. An unauthenticated remote access path into Screen Sharing is a high-severity issue for any deployment where the service is enabled, and in enterprise and education Mac fleets, Screen Sharing is frequently turned on for remote support and management. The attack surface is the local network, which narrows the threat model somewhat: the attacker needs network adjacency rather than arbitrary internet reachability. But "on the network" includes any compromised device on the same segment, a guest Wi-Fi connection bridged onto a corporate network, or a pivot through an already-breached machine. In a flat network without segmentation, that surface can extend quite far.

The absence of a beta cycle adds a practical wrinkle for IT teams. Apple's beta program gives administrators a window to test compatibility before general availability. Without that window, the usual MDM-guided deployment (staged pilot, validation, then fleet-wide push) gets compressed. The single-patch scope helps here: rather than validating a broad set of fixes, teams need only confirm that the Screen Sharing component update does not disrupt existing remote management workflows. Still, deploying without pre-validation carries its own risk, and organizations that depend on Screen Sharing for help-desk operations will want to verify that the service still authenticates correctly under the patched version before a full rollout.

The fact that Apple shipped this outside its normal cadence, ten days after a substantial 210-CVE cycle, tells us the company treated the Screen Sharing bypass as time-sensitive enough to bypass its release engineering norms. We do not have a CVE identifier, exploit-in-the-wild confirmation, or attribution from the verified sources. What we do have is a patch for an authentication bypass in a networked remote access component, released with minimal preamble across three supported macOS generations.

For administrators, the guidance is straightforward: identify all Macs running Tahoe, Sequoia, or Sonoma with Screen Sharing enabled, prioritize those on shared or low-trust network segments, and deploy 26.6.1, 15.7.9, or 14.8.9 respectively. Given the vulnerability class, this is one to patch quickly rather than on the next routine cycle.