CVE-2026-65400: macOS Screen Sharing Auth Bypass Fuels Cryptojacking Wave

Background

macOS’s built-in Screen Sharing service implements remote desktop access over VNC-derived protocols, listening on TCP port 5900 when enabled. It supports Secure Remote Password (SRP) authentication as one of its credential mechanisms — a cryptographic handshake designed so that a client can prove knowledge of a password without ever transmitting it.

Apple patched CVE-2026-65400 on August 6, 2026, in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. The Dutch National Cyber Security Centre reported on August 12 that attackers were actively exploiting the flaw against Macs with Screen Sharing exposed to the internet, gaining root access and installing Monero cryptocurrency miners in every case observed. CISA added the CVE to its Known Exploited Vulnerabilities catalog on August 18, with a remediation deadline of August 21.

Technical Mechanism

CVE-2026-65400 is an authentication bypass in the SRP handshake implementation within the Screen Sharing daemon. The flaw sits in the frame-length validator: under certain malformed input conditions, the validator erroneously returns a stale success status left over from a prior validation state, causing the connection to be treated as authenticated even though the SRP exchange never actually completed successfully.

The practical effect is that an attacker can open a connection to the Screen Sharing service and have it accepted as authenticated without supplying any valid credentials — no VNC password, no user account, no prior session. Because the bypass occurs at the authentication layer itself rather than after it, the resulting session also lacks the cryptographic protection SRP is meant to establish going forward, leaving it as a cleartext session once the false-positive authentication state takes hold.

From there, the path to root is via SSFileCopySender, a helper process associated with Screen Sharing’s file transfer capability that operates with root privileges. An attacker riding the authentication bypass can direct this helper to read and write arbitrary files as root. That alone is sufficient for full system compromise: writing a LaunchDaemon plist to achieve persistent root code execution, or modifying a shell startup file to achieve execution on next login, are both reachable from an arbitrary root file write. The helper’s privileges also extend to the kTCCServiceSystemPolicyAllFiles entitlement, which bypasses macOS’s Transparency, Consent, and Control protections that would otherwise restrict access to sensitive user data.

This is a related but distinct bug from CVE-2026-43760, also addressed in the same patch cycle. CVE-2026-43760 requires the attacker to already hold valid credentials via legacy VNC authentication methods before reaching its impact. CVE-2026-65400 requires no authentication whatsoever, which is why it carries the higher severity rating and represents the more urgent of the two for any Mac with Screen Sharing internet-exposed.

Real-World Exploitation Evidence

The Dutch National Cyber Security Centre’s August 12 report is the primary public documentation of active exploitation. Attackers are targeting Macs with port 5900 (Screen Sharing) directly exposed to the internet — a configuration more common than it should be, given Screen Sharing is often enabled for legitimate remote support use cases without adequate network-level restriction.

In every case NCSC observed, successful exploitation led to root access followed by installation of a Monero (XMR) cryptocurrency miner. This is consistent with opportunistic, scanning-driven exploitation rather than a targeted campaign: an unauthenticated root-access bug against internet-facing infrastructure is exactly the profile that draws cryptojacking operators running mass internet scans for exposed services, since the monetisation model (mining) doesn’t require any specific knowledge of the victim.

Impact Assessment

Root access via an unauthenticated network bypass is about as severe as single-host impact gets. Beyond the cryptojacking activity currently observed:

• Full read/write access to any file on the system as root, including credentials, SSH keys, and browser-stored secrets
• TCC bypass via kTCCServiceSystemPolicyAllFiles removes the last line of defence around sensitive user data (Photos, Messages, Mail, etc.)
• Persistent access via LaunchDaemon creation survives reboots and standard user-level remediation attempts
• Cryptomining payloads observed so far are a lower bound on attacker intent — the same access supports credential theft, data exfiltration, or use as a pivot point into any network the Mac is connected to
• Any Mac with Screen Sharing enabled and port 5900 reachable from an untrusted network is exposed, regardless of whether a VNC password is set, since the bypass sidesteps authentication entirely

Affected Versions

Remediation Steps

1. Apply the August 6, 2026 security updates immediately — macOS Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9 depending on your installed release.

2. Disable Screen Sharing if not actively required. System Settings → General → Sharing → turn off Screen Sharing. This eliminates the attack surface entirely regardless of patch status.

3. Never expose port 5900 directly to the internet. If remote screen sharing access is a genuine business need, place it behind a VPN rather than port-forwarding or otherwise exposing it publicly. This single change would have prevented the entire observed exploitation campaign.

4. Check for existing compromise on any Mac that has had Screen Sharing enabled and internet-reachable prior to patching — look for unexpected LaunchDaemons, unfamiliar cron/launchd persistence, and CPU usage patterns consistent with cryptomining (sustained high CPU from unfamiliar processes).

5. Rotate credentials stored on any Mac suspected of compromise, given the TCC bypass provides broad access to stored secrets and sensitive application data.

Detection Guidance

Host indicators:

Check for unfamiliar LaunchDaemon plists in /Library/LaunchDaemons/ created outside of known software installation activity, and review shell startup files (.zshrc, .bash_profile, /etc/profile) for unexpected modifications.

ls -la /Library/LaunchDaemons/ | sort -k6,7
find / -newer /var/db/.AppleSetupDone -name "*.plist" -path "*LaunchDaemon*" 2>/dev/null

Cryptomining indicators:

Sustained high CPU utilisation from unfamiliar or obfuscated process names is the most direct signal for the observed campaign. Check Activity Monitor or top output for processes consuming significant CPU with no legitimate application association, and review outbound network connections for mining pool traffic (commonly on ports 3333, 4444, 5555, 7777, or 14444).

Network indicators:

Any inbound connection to TCP port 5900 from an external, non-administrative IP address should be treated as suspicious if Screen Sharing is enabled — legitimate remote support access should come from known, expected source ranges.

protocol:tcp AND dst_port:5900 AND src_ip:external
| stats count by src_ip, dst_ip

Timeline

References

• The Hacker News — Apple macOS Screen Sharing Flaw Exploited on Internet-Exposed Macs to Install Monero Miner
• Huntress — From Screen Share to Root Access: Breaking Down CVE-2026-43760 and CVE-2026-65400 on macOS
• Malwarebytes — Update your Mac: Screen Sharing vulnerability exploited in the wild
• CISA — Known Exploited Vulnerabilities Catalog