macOS Screen Sharing Actively Exploited: Monero Miner Installed on Exposed Systems

Vulnerability Allows Authentication Bypass

The Netherlands’ National Cyber Security Centre (NCSC) has reported active exploitation of CVE-2026-65400, a vulnerability in macOS Screen Sharing, the built-in remote desktop control feature.

The disclosure was made public on August 14, 2026, after publicly available exploit code reportedly facilitated attacks. The issue involves authentication-state handling: an attacker with network access can authenticate to the service without valid credentials.

Screen Sharing relies on the VNC protocol and normally uses TCP port 5900. When this port is directly reachable from the Internet, the service becomes a remote entry point for anyone able to identify a vulnerable host.

The vulnerability is classified under CWE-287, which covers improper authentication. The full identifier is CVE-2026-65400.

Attacks Resulted in Root Privileges

The NCSC observed abuse on multiple macOS systems with port 5900 publicly exposed. In all cases reported to the agency, the attackers gained root access and installed a Monero cryptocurrency miner.

Mining consumes CPU, memory, and power, slows the device, and can increase operating costs. However, the risk goes beyond performance: root access allows attackers to modify files, applications, and security settings with the highest level of local privilege.

Remote access may also allow attackers to:

• open and use applications;
• read files stored on the Mac;
• modify security configurations;
• install additional components;
• alter system processes and services.

It is not known whether the campaign is still ongoing, how many devices were compromised, or whether the attackers pursued objectives beyond cryptomining. Available information also does not confirm the involvement of services other than Screen Sharing.

Affected Versions and Available Updates

The NVD record lists the affected product as apple macos < 14.8.9. The reported fixed versions are:

• macOS Sequoia 15.7.9;
• macOS Sonoma 14.8.9;
• macOS Tahoe 26.6.1.

Apple addressed CVE-2026-65400 on August 6, releasing the fix in macOS Tahoe 26.6.1 and the affected previous releases.

The scope described in the NVD record does not exactly match the list of fixed releases. Administrators should therefore verify the installed version and apply the update provided by Apple for that operating-system branch, rather than relying solely on the 14.8.9 cutoff.

The fix improves authentication-state handling by enforcing stricter credential validation and blocking the fraudulent attempts described in the vulnerability.

High Severity and Different CVSS Assessments

The NVD assigns the flaw a CVSS v3 score of 7.1, with the following vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Another assessment available in the archive assigns a CVSS score of 9.8, with the following vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The difference stems from the parameters assigned to the exploitation conditions and impact. In both cases, the vulnerability is network-reachable and requires no user interaction. The incidents observed by the NCSC add a concrete dimension to the assessment: the flaw is not merely theoretical, but has been used to obtain elevated privileges and install software on affected systems.

It is not known whether CVE-2026-65400 has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog. Consequently, no CISA deadline is currently associated with this vulnerability.

What Administrators and Users Should Do

The first step is to install one of the fixed releases listed by Apple. Systems that cannot be updated immediately should be treated as exposed, especially when Screen Sharing is enabled and TCP/5900 is accessible from the Internet.

If remote control is not required, it can be disabled under:

System Settings → General → Sharing → Screen Sharing

Port 5900 should also be removed from direct Internet exposure using firewalls, router rules, or network segmentation. When remote access is essential, it should not be exposed without appropriate network protections.

On systems potentially reachable through that port, it is advisable to check for:

• recent Screen Sharing connections and access attempts;
• unauthorized accounts or activity involving root privileges;
• processes using unusually high CPU resources persistently;
• files or services associated with Monero mining;
• unexpected changes to security settings;
• new firewall rules, scheduled tasks, or unknown startup items.

The presence of a miner does not rule out further compromise. A system on which root access was obtained should therefore be isolated, analyzed, and, when necessary, restored according to incident-response procedures rather than merely having the mining process removed.