Listen to this Post
A Dangerous Race Between Apple’s Patch and Cybercriminals
A critical vulnerability in macOS has moved from a security advisory to an active exploitation problem in remarkably little time. The Dutch National Cyber Security Centre (NCSC-NL) has confirmed that attackers are exploiting CVE-2026-65400, a critical authentication flaw in Apple’s built-in Screen Sharing service that carries a CVSS score of 9.8.
The most troubling part is not simply that the vulnerability exists. Apple already released security updates addressing it. The real danger is the narrow window between the availability of a patch and the moment attackers begin exploiting vulnerable systems.
That window is becoming increasingly dangerous.
For Mac administrators, businesses, universities, remote workers, and anyone who has exposed Screen Sharing to the public internet, this incident is another reminder that a patched vulnerability is not automatically a protected system. A machine remains vulnerable until the update is actually installed, and internet-facing services can be discovered and attacked surprisingly quickly.
What Is CVE-2026-65400?
CVE-2026-65400 affects the authentication mechanism used by macOS Screen Sharing, Apple’s built-in remote desktop functionality.
The vulnerability is classified as a critical authentication flaw. An attacker positioned on the network could potentially authenticate to Screen Sharing without possessing legitimate credentials.
In practical terms, that means an attacker does not necessarily need to steal a password before attempting to access an exposed Mac.
The fundamental problem lies in how the Screen Sharing component manages authentication state. Under particular circumstances, network traffic can cause the authentication process to accept attempts that should have been rejected.
That makes this fundamentally different from a conventional password attack.
Apple Released the Fix, But Attackers Moved Quickly
Apple addressed CVE-2026-65400 through security updates for multiple supported macOS versions.
The affected platforms were patched through:
macOS Tahoe 26.6.1
macOS Sequoia 15.7.9
macOS Sonoma 14.8.9
Apple credited security researcher Alfredo Pesoli (@__rev) of Bynario Atlas for discovering and reporting the vulnerability.
The company described the underlying problem as an issue where a network attacker could potentially authenticate to Screen Sharing without valid credentials.
That wording sounds relatively simple.
The consequences are anything but simple.
Port 5900 Became the Doorway
Screen Sharing commonly operates through TCP port 5900.
That becomes particularly dangerous when the service is exposed directly to the internet.
According to NCSC-NL, it received reports that multiple systems with port 5900 accessible from the public internet had already been compromised.
The attackers did not merely demonstrate that authentication could be bypassed.
They obtained root access.
That distinction is enormous.
Root access effectively places the attacker in a position where they can control critical portions of the operating system, install software, modify configurations, access files, establish persistence, and potentially use the machine as a launching point for additional attacks.
The Attackers Installed Monero Miners
So far, the observed attackers appear to have used their access primarily for cryptocurrency mining.
NCSC-NL reported that compromised systems were infected with a Monero cryptocurrency miner.
At first glance, that may sound less frightening than ransomware, espionage malware, or data theft.
In reality, the mining payload may simply be the visible part of a much larger problem.
A cryptominer consumes CPU resources, electricity, memory, and network bandwidth. It can also degrade system performance and increase operational costs.
But the bigger concern is how the attackers obtained the ability to install it in the first place.
They reached a point where the operating system effectively trusted them.
The Miner Is Not the Worst-Case Scenario
Cryptocurrency mining is often an opportunistic criminal business.
Attackers scan large numbers of systems, compromise whatever they can, install automated mining software, and move on to the next target.
That behavior may indicate that the current campaign is more opportunistic than highly targeted.
But defenders should not become comfortable because the attackers chose a miner.
A root-level compromise could potentially support much more damaging operations.
An attacker could attempt to:
Steal sensitive files.
Deploy additional malware.
Create persistence.
Modify system configurations.
Harvest credentials.
Pivot into internal networks.
Disable security controls.
Install remote-access mechanisms.
Exfiltrate data.
Use the compromised Mac as infrastructure for another campaign.
The payload observed today does not define everything an attacker could have done tomorrow.
The Bigger Problem: Internet-Exposed Macs
CVE-2026-65400 becomes especially dangerous when Screen Sharing is reachable from the public internet.
A Mac sitting behind properly configured network controls is one thing.
A Mac exposing port 5900 directly to the internet is another.
Once a service becomes externally reachable, attackers do not need to know the owner’s identity or specifically target the machine. Automated scanners can discover exposed services continuously.
This is where modern cybercrime becomes industrialized.
Attackers do not necessarily sit behind a keyboard searching manually for vulnerable Macs.
They can automate discovery, exploitation, installation, and monetization.
Thousands of Screen Sharing Systems Were Already Visible
The danger surrounding Screen Sharing is not entirely new.
Earlier research into related vulnerabilities reportedly found tens of thousands of Screen Sharing hosts accessible from the internet.
One researcher identified approximately 40,000 exposed Screen Sharing systems, with a significant portion located in the United States.
The exposed systems reportedly included residential connections, university networks, and corporate infrastructure.
That statistic matters because vulnerability severity is only one part of the equation.
A critical vulnerability affecting a service that nobody exposes is a very different problem from a critical vulnerability affecting a service that thousands of machines place directly on the internet.
Related Screen Sharing Vulnerabilities Raise More Questions
CVE-2026-65400 also appears in a broader pattern of security problems affecting macOS Screen Sharing.
Apple had already addressed other Screen Sharing vulnerabilities in an earlier macOS release.
One previously reported flaw was described as particularly concerning because exploitation could reportedly be initiated with little more than the target’s IP address.
That history suggests defenders should not view CVE-2026-65400 as an isolated incident.
When several vulnerabilities affect the same security-sensitive component within a short period, security teams should consider whether additional weaknesses could remain undiscovered.
Logic Bugs Can Be More Dangerous Than Memory Corruption
One of the most interesting technical aspects of this incident is that the vulnerabilities reportedly do not depend on classic memory-corruption techniques.
Security researchers analyzing the flaws found authentication logic problems rather than the kind of complicated memory manipulation commonly associated with sophisticated exploitation.
That is significant.
Modern security discussions often focus heavily on buffer overflows, use-after-free vulnerabilities, heap corruption, and other memory-safety problems.
But authentication logic can be just as devastating.
If an application incorrectly decides that an attacker has successfully authenticated, there may be no need for a complicated exploit chain.
The attacker simply has to convince the application that the authentication process succeeded.
A Few Packets Can Become a Security Disaster
According to the research described in the original report, the vulnerable behavior could be triggered through carefully ordered network packets.
That means exploitation can potentially be much simpler than attacks that require complicated memory corruption.
The difference is important.
A complicated exploit might require deep reverse engineering, specialized knowledge, and extensive testing.
A logic flaw can sometimes require nothing more than understanding the expected sequence of messages and finding a way to make the software accept an invalid state.
That simplicity is exactly what makes authentication vulnerabilities dangerous.
AI Is Changing the Exploit Development Equation
Perhaps the most unsettling detail in this incident is the reported use of an AI coding agent during exploit development.
Security researchers reportedly developed working exploits for related vulnerabilities in only a few hours using an AI coding agent.
The significance is not that AI magically creates zero-days.
It does not.
The more important development is that AI can reduce the amount of repetitive engineering work required after a vulnerability has been understood.
An experienced researcher still needs to understand the protocol, identify the vulnerable behavior, test assumptions, and validate results.
But AI can accelerate coding, debugging, packet construction, experimentation, and iteration.
That changes the economics of vulnerability research.
The Exploit Gap Is Getting Smaller
There was once a larger separation between the moment a vulnerability was disclosed and the moment criminals could reliably exploit it.
That gap is shrinking.
Today, defenders have to assume that public vulnerability information can quickly become actionable intelligence for attackers.
Once a patch is released, security researchers, criminal groups, automated scanners, and vulnerability analysts may all begin examining the same software.
The paradox is uncomfortable:
The patch announcement itself can become a signal telling attackers exactly where to look.
Why Patch Tuesday Thinking Is Not Enough
Organizations sometimes treat security updates as a scheduled administrative task.
That approach is increasingly dangerous for internet-facing vulnerabilities.
A critical remote-access authentication vulnerability should not necessarily wait for the next maintenance window.
The priority should be determined by exposure, exploitability, privilege impact, and evidence of active exploitation.
CVE-2026-65400 checks several alarming boxes at once:
Critical severity.
Authentication bypass potential.
Network-accessible attack surface.
Active exploitation.
Root-level compromise reported.
Cryptocurrency-mining payload observed.
That combination deserves immediate attention.
What Mac Users Should Do Right Now
If Screen Sharing is enabled on a Mac running an affected version of macOS, installing the appropriate security update should be treated as a priority.
The safest approach is straightforward:
Update macOS immediately.
Check whether Screen Sharing is enabled.
Determine whether port 5900 is reachable from the internet.
Disable Screen Sharing if it is not required.
Review firewall and router rules.
Investigate unusual CPU usage or mining activity.
Check for unexpected accounts and persistence mechanisms.
Review network logs for suspicious connections.
Treat previously exposed systems as potentially compromised if evidence exists.
Updating is the first step, not necessarily the final step.
If You Cannot Patch Immediately
If immediate updating is impossible, disabling Screen Sharing is a sensible temporary mitigation when the service is not essential.
The goal should be to eliminate external access to the vulnerable functionality.
If remote desktop access is genuinely required, organizations should carefully restrict access through appropriate network controls rather than exposing TCP port 5900 directly to the public internet.
Remote administration should not automatically mean unrestricted internet exposure.
Deep Analysis: Understanding the Attack Surface
Identify Whether Screen Sharing Is Enabled
On macOS, administrators can inspect relevant sharing configuration from the command line.
sudo launchctl print system/com.apple.screensharing
Depending on the macOS version and configuration, the output can help determine whether the Screen Sharing service is loaded.
Check Whether Port 5900 Is Listening
A basic local check can identify whether something is listening on TCP port 5900:
sudo lsof -nP -iTCP:5900 -sTCP:LISTEN
Another option is:
sudo netstat -an | grep '.5900 .LISTEN'
These commands should be interpreted according to the specific macOS version because networking utilities and service behavior can change between releases.
Check the Local Firewall Configuration
Administrators can inspect the macOS application firewall state with:
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
A firewall being enabled does not automatically mean Screen Sharing is safely configured. Network exposure must still be evaluated at the router, gateway, VPN, and firewall layers.
Inspect Active Network Connections
For incident investigation, administrators can examine current connections with:
sudo lsof -nP -i
Suspicious external connections deserve additional investigation, particularly if they originate from unfamiliar processes.
Look for Unusual Resource Consumption
Cryptocurrency miners often generate unusually high CPU utilization.
A quick command-line check is:
top -o cpu
A Mac that suddenly maintains extremely high CPU usage while performing no legitimate computational workload deserves investigation.
Search for Unexpected Processes
Administrators can review running processes with:
ps aux
The presence of unfamiliar processes does not automatically prove compromise, but unexpected binaries consuming substantial CPU resources can be an important indicator.
Check for Unexpected Users
A basic account review can be performed with:
dscl . list /Users
Administrators should compare the results with known legitimate accounts.
Check Login and System Activity
Security teams can also examine relevant logs through macOS’s unified logging system:
log show --last 24h
For a real investigation, the query should be narrowed to relevant processes, services, authentication events, and suspicious timestamps rather than treating the entire output as evidence.
Do Not Assume a Miner Is the Only Payload
This is the most important incident-response principle in this case.
If a vulnerable Mac was successfully exploited, removing the cryptocurrency miner alone may not be enough.
Attackers with root-level access could have created persistence or installed additional tools.
For confirmed compromise, organizations should consider containment, forensic acquisition, credential rotation, and potentially rebuilding the affected system from a trusted source.
What Undercode Say:
The Real Story Is Bigger Than a Monero Miner
CVE-2026-65400 should not be viewed simply as another macOS vulnerability.
It represents the collision of three dangerous trends.
First, remote administration services remain attractive targets.
Second, internet exposure continues to create enormous automated attack surfaces.
Third, the time required to turn vulnerability research into practical exploitation is shrinking.
Apple’s Speed Deserves Credit
Apple deserves credit for releasing patches across supported macOS branches.
The company did not leave users waiting indefinitely for a fix.
The problem is that attackers only need one vulnerable machine.
Defenders need to protect every exposed machine.
Attackers Only Need One Open Door
A company may have hundreds or thousands of Macs.
If one machine has Screen Sharing exposed directly to the internet, that machine can become the entry point.
Security is therefore not simply about how many systems are patched.
It is about whether the vulnerable systems remain reachable.
Exposure Can Matter More Than Severity
A critical vulnerability behind several layers of network controls may be relatively difficult to exploit.
A critical vulnerability exposed on TCP port 5900 is a different story.
Internet accessibility transforms theoretical risk into something attackers can repeatedly scan.
Authentication Bugs Deserve More Attention
Authentication vulnerabilities are particularly dangerous because they attack trust rather than memory.
If the application makes the wrong decision about who is authenticated, the attacker can bypass the security boundary itself.
Simple Bugs Can Produce Severe Outcomes
There is an important misconception that a devastating vulnerability must involve sophisticated exploitation.
CVE-2026-65400 demonstrates the opposite possibility.
A relatively straightforward logic error can produce catastrophic consequences when it exists inside a privileged remote-access service.
Remote Desktop Services Are High-Value Targets
Screen Sharing provides exactly what attackers want: remote interaction with another computer.
Any vulnerability that allows unauthorized access to such functionality should therefore receive elevated defensive priority.
Port 5900 Should Not Be Casually Exposed
There is rarely a good reason for an ordinary workstation’s remote desktop service to be freely reachable from the entire internet.
Organizations should ask why the service is exposed before asking how to protect it.
Removing unnecessary exposure is often more effective than adding another security product.
Internet Scanning Is Cheap
Attackers can continuously scan huge address ranges.
They do not need to know that a particular Mac belongs to a particular company.
The scanner simply looks for the service.
If the service responds, the machine enters the attacker’s workflow.
Automated Exploitation Changes the Equation
Once exploitation can be automated, the attacker no longer needs to manually operate against every target.
Discovery can be automated.
Testing can be automated.
Exploitation can be automated.
Payload deployment can be automated.
Cryptocurrency mining can also be automated.
AI Adds Another Accelerator
AI coding tools can reduce the friction involved in exploit development.
That does not mean every vulnerability becomes instantly exploitable.
It means the engineering burden between understanding a flaw and building working tooling can become smaller.
Defenders Also Have AI
This is not exclusively an attacker advantage.
Defenders can use AI to analyze logs, identify suspicious patterns, generate detection rules, summarize vulnerability advisories, and accelerate incident-response workflows.
The competition is becoming increasingly automated on both sides.
Patch Releases Can Reveal Attack Paths
When vendors publish detailed vulnerability information, researchers learn where the security boundary was weak.
Attackers can study the same information.
This creates a race between patch deployment and exploitation.
The Clock Starts at Disclosure
Organizations should think of vulnerability disclosure as the beginning of an operational countdown.
The question should not be, “When can we install this?”
The better question is, “How quickly can we eliminate the exposure?”
Home Users Are Part of the Problem Too
Corporate security teams are not the only defenders involved.
Residential Macs can expose services through router configuration, port forwarding, remote-access tools, or other network settings.
Home users often lack centralized patch management.
That makes them attractive targets for automated campaigns.
Universities Have Special Exposure
University networks can contain thousands of heterogeneous systems.
Students, researchers, faculty, laboratories, and administrative departments may operate different configurations.
A vulnerable remote-access service can therefore become difficult to inventory quickly.
Root Access Changes Everything
Once attackers obtain root privileges, defenders must stop thinking only about the original vulnerability.
The question becomes whether the entire system can still be trusted.
Cryptocurrency Mining Is a Warning Signal
A Monero miner may appear financially motivated and relatively harmless compared with ransomware.
But its presence demonstrates successful unauthorized access.
The miner is evidence of compromise, not evidence that the attacker had limited ambitions.
Todays Miner Could Become Tomorrows Backdoor
Attackers can change payloads.
A criminal campaign that currently deploys miners could later deploy credential stealers, ransomware, proxies, or botnet software.
Security teams should never build their threat model around the attacker’s current payload alone.
Screen Sharing Should Be Treated as Critical Infrastructure
Remote administration services should receive stronger monitoring than ordinary desktop applications.
They cross a fundamental boundary: they allow another system to interact with the computer remotely.
Least Privilege Still Matters
Even if a vulnerability grants powerful access, limiting unnecessary privileges elsewhere can reduce the consequences of compromise.
Security architecture should assume that some defenses will eventually fail.
Network Segmentation Provides a Second Line of Defense
A vulnerable workstation should not automatically provide a path into every internal system.
Segmentation can prevent a single compromised endpoint from becoming an enterprise-wide disaster.
Monitoring Port 5900 Is Easy
Organizations can monitor firewall and network telemetry for unexpected inbound connections to TCP 5900.
Unexpected public exposure should trigger investigation.
Vulnerability Management Must Include Exposure Management
Knowing that a vulnerability exists is not enough.
Security teams need to know which machines are vulnerable, which are exposed, which are reachable from untrusted networks, and which have evidence of exploitation.
Asset Inventory Is Fundamental
You cannot patch what you do not know exists.
Organizations should maintain accurate inventories of Macs, operating-system versions, enabled services, and network exposure.
Security Advisories Should Trigger Action
A critical advisory involving active exploitation should not disappear into an email inbox.
It should produce a workflow.
Identify.
Prioritize.
Patch.
Verify.
Monitor.
Verification Matters After Patching
Installing an update is not the same as proving that the exposure has disappeared.
Security teams should verify the operating-system version and confirm that vulnerable services are no longer unnecessarily reachable.
Compromised Hosts Need Deeper Investigation
If there is evidence that attackers successfully accessed a machine, patching alone may not restore trust.
The system should be investigated according to the organization’s incident-response procedures.
Credentials May Need Rotation
If unauthorized access occurred, credentials associated with the machine may need to be considered potentially exposed.
This is especially important for administrator accounts and credentials stored or used on the affected system.
Persistence Is the Hidden Threat
A sophisticated attacker does not necessarily leave immediately after installing a miner.
They may establish persistence for later access.
That is why post-compromise investigation matters.
The Mac Myth Needs to End
Mac security has historically benefited from a perception of being safer than some competing platforms.
But safer does not mean immune.
A critical vulnerability in a widely deployed remote-access component can still create a major security crisis.
Security Is a Process, Not a Product
No firewall, antivirus application, endpoint agent, or operating system can eliminate every vulnerability.
Good security comes from reducing exposure, applying patches quickly, monitoring continuously, and responding intelligently.
The Most Important Lesson
The central lesson from CVE-2026-65400 is simple:
Do not expose unnecessary remote administration services to the internet.
And when a critical vulnerability affects one that is already exposed, speed matters.
The Patch Is Only Half the Solution
Apple can release the fix.
Researchers can disclose the vulnerability.
Security vendors can publish detections.
But the final decision still happens on the endpoint.
Someone has to install the update.
Someone has to close the port.
Someone has to verify the system.
That operational layer is where security succeeds or fails.
✅ CVE-2026-65400 Is a Critical macOS Vulnerability
The supplied article identifies CVE-2026-65400 as a critical Screen Sharing authentication vulnerability with a CVSS score of 9.8. The described impact involves unauthorized authentication over the network.
✅ Active Exploitation Has Been Reported
The article states that NCSC-NL observed active exploitation against systems with TCP port 5900 exposed to the internet. This makes the vulnerability significantly more urgent than a purely theoretical security weakness.
✅ Root Access and Monero Mining Were Reported
According to the supplied report, compromised systems were successfully accessed with root privileges and subsequently used to run Monero mining software. The mining activity is therefore an observed consequence of exploitation, not merely a theoretical possibility.
❌ Installing the Patch Does Not Prove a Previous Compromise Never Happened
A system that was vulnerable before patching could potentially have been compromised during that period. Updating closes the vulnerability, but organizations should investigate suspicious systems when there is evidence that exploitation may already have occurred.
Prediction
(+1) Apple Will Continue Hardening Screen Sharing
The concentration of security issues around remote-access functionality is likely to push Apple toward additional scrutiny of Screen Sharing authentication and state-management logic.
(+1) Organizations Will Restrict Internet-Facing Remote Desktop Services
Incidents like this are likely to accelerate the move toward VPNs, zero-trust access models, private networks, and identity-aware remote administration instead of exposing remote desktop ports directly to the internet.
(+1) AI-Assisted Security Research Will Accelerate
The reported ability to use AI coding agents during exploit development is an early indication of a broader shift. Security researchers and attackers will increasingly use AI to automate repetitive exploitation and analysis tasks.
(-1) Exploitation Windows Will Become Shorter
The time between vulnerability disclosure, patch availability, public technical analysis, and exploitation is likely to continue shrinking.
(-1) Internet-Exposed Macs Will Remain Attractive Targets
As long as vulnerable remote-access services remain publicly reachable, automated attackers will continue scanning them. The combination of critical authentication flaws and exposed services creates exactly the kind of low-friction opportunity cybercriminals prefer.
(+1) Patch Speed Will Become a Competitive Security Advantage
Operating-system vendors that can quickly identify, fix, and distribute patches will have an important advantage. But organizations that cannot deploy those patches quickly will remain exposed regardless of how fast the vendor responds.
The Final Warning: Patch the Mac, Close the Door
CVE-2026-65400 is a powerful reminder that modern cyberattacks do not always begin with sophisticated malware or elaborate social engineering.
Sometimes, the attacker simply finds a service listening on the internet.
Sometimes, the service contains a logic error.
Sometimes, a few network messages are enough to cross the authentication boundary.
And sometimes, by the time defenders finish reading the advisory, somebody has already started exploiting it.
For anyone running an affected version of macOS, the practical message is straightforward: install the appropriate Apple security update, disable Screen Sharing if it is unnecessary, and make sure TCP port 5900 is not unnecessarily exposed to the public internet.
The Monero miner may be what investigators see today.
The more important question is what attackers could do tomorrow if the same door remains open.
▶️ Related Video (74% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: securityaffairs.com
Extra Source Hub (Possible Sources for article):
https://www.medium.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
