Attackers are logging in to Macs without a password through Screen Sharing

On 6 August 2026 Apple shipped an update for macOS outside its normal cycle, and it fixed a single vulnerability in Screen Sharing. Apple describes the impact as an attacker on the network being able to authenticate to Screen Sharing without valid credentials, and states that the authentication issue was addressed with improved state management. The vulnerability is tracked as CVE-2026-65400, and it is fixed in macOS Tahoe 26.6.1, Sequoia 15.7.9 and Sonoma 14.8.9. On 12 August the Dutch NCSC updated its advisory to say that public exploit code exists and that active abuse is known. The NCSC states that the abuse was seen on several systems where port 5900 was reachable from the internet, that root access was obtained on those machines, and that a program mining the cryptocurrency Monero was installed.

What happens technically

Screen Sharing lets somebody connect to a Mac from another machine, see the screen and drive the keyboard and mouse as though sitting in front of it. The feature is useful, and that is exactly why it is switched on in so many places. A Mac mini in a cupboard, a machine in a laboratory, a colleague who needs help. When Screen Sharing is enabled, the macOS firewall opens port 5900. Ars Technica notes that routers and dedicated firewalls usually block that port further out unless somebody has decided otherwise, and that is where the difference between a safe machine and an exposed one lies. Ars Technica gives the severity as 7.1 out of 10.

The flaw itself is a logic bug rather than a memory bug. The security firm Calif built a working exploit by comparing Apple's update with the release before it, and describes the flaw as the authentication state machine falling out of step. A length check bails out early on an oversized packet and hands back a value that happens to be the success code from the read just before it. The caller reads that as the authentication step having passed, and advances to the next state. There is no race to win, no memory protection to defeat and no crash. Calif is holding back the full details until more people have had time to update.

Two things decide how serious this becomes. The first is that the service answering on port 5900 runs as root, the account that can do anything on the machine. An attacker therefore does not stop at the account used to log in. The second is that this flaw needs a username, and a username is no secret, since macOS displays them on the login screen. How many machines are exposed is less certain. Calif cites a scan by the researcher @osxreverser that found around 40,000 machines with Screen Sharing open to the internet, almost half of them in the United States. The number comes from a single scan at a time that is not stated, and should be read as an order of magnitude.

What this means for you if you run Macs

If you have Macs in the organisation, your question is not whether the flaw is serious, but how many of your machines have Screen Sharing switched on. Our experience is that the answer is rarely zero, and that it is almost never known in advance. The feature gets enabled once to solve something specific, and then it stays on. The machine to look for first is the one sitting in a cupboard or a rack doing a single job, because it was set up long ago by somebody who may no longer work here.

Berigo assesses that this should be handled as an incident rather than merely as an update. Exploitation is active, the code is public, and a successful attack yields root on the machine. Patching is then an incomplete answer, because it closes the hole without telling you whether anyone got in before you closed it. If you have had a Mac with port 5900 open to the internet, look for what the NCSC actually describes, namely a process using unusual amounts of processor time, and accounts or keys that have been added without anybody being able to account for them. Under NIS2 article 21 this is both vulnerability handling and incident handling, and it is the two together that have to be documented afterwards.

Berigo recommends

• Install macOS Tahoe 26.6.1, Sequoia 15.7.9 or Sonoma 14.8.9 on every Mac, including those missing from your asset list.
• Switch Screen Sharing off where it is not in use, under System Settings, General and Sharing.
• Check whether port 5900 is open to the internet from your own network, and close it in the firewall if it is.
• Where somebody needs Screen Sharing, put it behind a VPN or behind a rule that admits known addresses only.
• If a machine has been exposed, examine it for unexpected processor use and for new accounts before you treat the matter as closed.