Listen to this Post
A Remote Access Feature Becomes a Dangerous Attack Path
A feature built to make Mac administration easier has suddenly become a serious security concern. Attackers are actively exploiting a recently patched vulnerability in macOS Screen Sharing, gaining root-level control of exposed systems and installing Monero cryptocurrency miners.
The Netherlands’ National Cyber Security Centre, NCSC-NL, reported that multiple internet-accessible Macs had already been compromised through the flaw. The attacks demonstrate an uncomfortable reality for administrators: a service intended for legitimate remote access can become a direct doorway into a machine when authentication itself is broken.
The vulnerability, tracked as CVE-2026-65400, affects the authentication mechanism used by macOS Screen Sharing. Apple addressed the issue on August 6, 2026, but Macs that remain unpatched and reachable from untrusted networks could still be exposed.
For organizations operating hosted Macs, development machines, build servers, remotely managed workstations, Mac minis or Mac Studios, this is more than a routine software update. A vulnerable system exposed through TCP port 5900 can potentially give an attacker a path straight to the operating system with no legitimate account credentials required.
What Happened to the Compromised Macs
NCSC-NL said threat actors exploited CVE-2026-65400 against multiple systems where Screen Sharing was accessible directly from the internet.
Once inside, the attackers achieved root-level access and installed software designed to mine Monero.
Cryptocurrency mining may sound less dangerous than ransomware or data theft, but the mining software is only one part of the incident. Root access gives an attacker considerably more power than simply consuming CPU resources.
A compromised Mac can potentially become a staging point for additional malware, a source of stolen credentials, a launchpad for attacks against internal systems or a persistent foothold inside an organization.
The visible miner may therefore be the least important part of the compromise.
CVE-2026-65400 Explained
CVE-2026-65400 is a critical authentication vulnerability affecting macOS Screen Sharing.
The flaw can allow a remote attacker to bypass the normal authentication process and gain access to the Screen Sharing service without providing valid credentials.
Apple described the underlying problem as an issue with state management in the authentication process. Technical research into the vulnerability indicates that the problem involves macOS’s implementation of Secure Remote Password authentication within the Screen Sharing service.
An error involving frame-length validation can cause the service to return an outdated success state.
In practical terms, the service may incorrectly believe authentication has succeeded when it has not.
That is an especially dangerous condition for a network-facing remote administration service.
Why Screen Sharing Is So Sensitive
Screen Sharing is
When enabled, it allows an authorized user to remotely view and control a Mac. Depending on the configuration, a remote administrator can open files, launch applications, move data, restart the computer and perform other administrative tasks.
The service relies on the Remote Framebuffer protocol, commonly associated with Virtual Network Computing, or VNC.
Screen Sharing normally uses TCP port 5900.
The port itself is not inherently dangerous. The problem occurs when a vulnerable service is reachable from an untrusted network, particularly when it is exposed directly to the public internet.
Screen Sharing Is Not Normally Enabled
Most standard Mac installations do not expose Screen Sharing automatically.
That reduces the immediate risk for ordinary home users who have never enabled the feature.
The situation changes considerably in professional environments.
Remote administration is common on enterprise Macs, development workstations, hosted Mac infrastructure and systems used for automated software builds.
Mac minis and Mac Studios are also increasingly used as remote servers, CI/CD machines and development infrastructure.
These systems can be configured for remote access intentionally, sometimes with internet accessibility that administrators may not realize is still active.
The Root Access Problem
The most serious aspect of CVE-2026-65400 is not cryptocurrency mining.
It is root-level access.
Root privileges can allow an attacker to manipulate files, execute commands, establish persistence and interfere with security controls.
An attacker who compromises a
A server used for software development can be particularly valuable because it may contain credentials that reach far beyond the compromised machine.
This is why organizations should treat exploitation as a potential full-system compromise rather than simply a cryptojacking infection.
Why Cryptojacking Is Still Dangerous
Cryptojacking quietly turns computing resources into profit for attackers.
Instead of encrypting files or immediately stealing information, the attacker installs mining software that uses the victim’s processor to generate cryptocurrency.
On a Mac, the warning signs can include unusually high CPU utilization, excessive fan activity, increased power consumption, overheating and noticeably degraded performance.
The financial impact can also extend beyond electricity costs.
Continuous processor utilization can reduce hardware lifespan, interfere with workloads and consume resources that organizations depend on for development or production tasks.
Most importantly, however, the miner proves that someone already obtained unauthorized access.
The Attack May Continue After the Miner Is Removed
Deleting the cryptocurrency miner is not enough.
An attacker who has obtained root privileges may have installed additional mechanisms for returning to the system.
Those mechanisms could include modified startup components, unauthorized accounts, malicious scripts, stolen credentials, remote-access tools or other forms of persistence.
A clean-looking Mac can therefore remain compromised even after the obvious mining process disappears.
This is one of the most important lessons from the incident.
The miner is evidence of compromise, not necessarily the complete compromise.
CVE-2026-65400 Is Different From CVE-2026-43760
Administrators should also distinguish this vulnerability from another recently disclosed Screen Sharing flaw, CVE-2026-43760.
The two vulnerabilities affect the same general remote-access technology but have different authentication requirements.
CVE-2026-43760 requires knowledge of a configured VNC password.
CVE-2026-65400 is considerably more dangerous because exploitation can reportedly occur before legitimate authentication.
That distinction changes the threat model dramatically.
An attacker does not necessarily need to obtain or guess an existing VNC password before attempting exploitation.
Apple Released Security Fixes
Apple patched CVE-2026-65400 on August 6, 2026.
The affected release families received fixes in:
macOS Tahoe 26.6.1
macOS Sequoia 15.7.9
macOS Sonoma 14.8.9
Older releases in these families should be treated as vulnerable until the applicable security update has been installed.
Unsupported macOS versions present an even greater concern because they may not receive the required security fixes.
Why Internet-Exposed Macs Are the Priority
Not every Mac is equally exposed.
The highest-risk systems are those where Screen Sharing is enabled and TCP port 5900 can be reached from the public internet or another untrusted network.
Hosted Macs deserve special attention because remote infrastructure providers may deploy machines with remote administration enabled.
Development and build servers are also attractive targets because they frequently contain valuable credentials and software-development infrastructure.
Organizations should not assume that a firewall is protecting these systems simply because a firewall rule exists.
Actual exposure should be tested.
What NCSC-NL Observed
NCSC-NL initially published its advisory on August 7 and updated it on August 12 after receiving information about active exploitation.
The agency reported that multiple systems had been compromised.
In the observed incidents, attackers obtained root privileges and installed Monero mining software.
NCSC-NL has not publicly disclosed the total number of compromised machines, the precise beginning of the attacks or whether additional malware was deployed.
That uncertainty should not be interpreted as evidence that the miner was the only payload.
Public Exploitation Raises the Stakes
Security researchers have also analyzed publicly available proof-of-concept material related to the vulnerability.
Once technical exploitation details become widely available, the defensive window can shrink quickly.
Attackers no longer need to discover the vulnerability independently. They can study existing research, identify exposed systems and automate portions of the attack process.
This is particularly concerning for internet-facing infrastructure.
A vulnerable Mac sitting unnoticed on port 5900 is not protected simply because nobody has attacked it yet.
The First Step Is Simple: Patch the Mac
The most important action is to install
On macOS, users can open:
System Settings → General → Software Update
Administrators should install all available security updates applicable to their systems.
Patching is essential because changing a password does not correct the underlying authentication vulnerability.
Neither does restricting user accounts.
If the vulnerable service remains exposed, the authentication weakness itself remains the problem.
Disable Screen Sharing When It Is Not Needed
If Screen Sharing is unnecessary, turn it off.
Go to:
System Settings → General → Sharing
Then review the Screen Sharing configuration and disable it if there is no operational requirement for the service.
Organizations should also review Remote Management and other remote-access settings.
Device-management policies can silently enable services across fleets, so administrators should verify the effective configuration rather than relying solely on individual user settings.
Never Expose Screen Sharing Directly to the Internet
A remote-access service does not need to be publicly reachable simply because administrators need remote access.
A safer architecture places remote management behind a trusted VPN, firewall or carefully controlled network-access mechanism.
IP allowlisting can provide another layer of restriction where appropriate.
The objective is straightforward: reduce the number of systems that an unknown internet host can directly reach.
Scan Your Own Infrastructure
Organizations should actively scan their external address ranges for exposed VNC and Screen Sharing services.
A security team may discover forgotten development machines, temporary test systems, hosted Macs or legacy infrastructure that were never removed from public exposure.
Asset inventories can become outdated.
Internet-facing scans provide a practical way to determine what the outside world can actually see.
Deep Analysis
Check for Listening Port 5900
On a Mac, administrators can inspect listening network services with:
sudo lsof -nP -iTCP:5900 -sTCP:LISTEN
A listening service does not automatically mean the machine is compromised, but it tells administrators that something is accepting connections on the standard VNC/Screen Sharing port.
Review Active Network Connections
Administrators can examine current TCP connections with:
sudo lsof -nP -iTCP
This can help identify unexpected remote connections and unfamiliar processes communicating over the network.
Check CPU Consumption
A suspicious cryptocurrency miner often produces abnormal processor activity.
Use:
top -o cpu
or:
ps aux | sort -nrk 3 | head
A process consuming unusually large amounts of CPU deserves investigation, particularly if the system is normally idle.
Inspect Running Processes
Administrators can review active processes with:
ps aux
Unknown binaries, strange execution paths or processes running with elevated privileges should be investigated rather than immediately deleted.
Review Launch Agents
Persistence mechanisms can be hidden in user and system launch locations.
Useful inspection commands include:
ls -la ~/Library/LaunchAgents
and:
sudo ls -la /Library/LaunchAgents
Administrators should investigate unfamiliar entries and correlate them with installation dates and known software.
Check System Launch Daemons
System-level persistence may also appear in:
sudo ls -la /Library/LaunchDaemons
Unexpected launch daemons should be treated carefully and investigated as part of a broader incident-response process.
Search for Recent Files
Administrators can investigate recently modified files with commands such as:
sudo find /Library /Users -type f -mtime -7 2>/dev/null
This should not be treated as a complete forensic scan, but it can help identify suspicious changes after a suspected intrusion.
Examine Logs
macOS logging can provide useful evidence:
log show –last 24h
For targeted investigation, administrators can filter the output for relevant services, authentication events or unusual process activity.
Verify Software Updates
The installed macOS version can be checked with:
sw_vers
Administrators should compare the installed version against
Check Firewall Configuration
The macOS application firewall can be inspected with:
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
However, firewall status alone should never be considered proof that TCP 5900 is inaccessible from the internet.
External validation is still required.
What to Do If a Mac May Already Be Compromised
If exploitation is suspected, administrators should avoid treating the incident as a simple malware-removal exercise.
First, preserve relevant evidence where practical.
Then isolate the affected Mac from sensitive networks.
A compromised machine with root access should not automatically be trusted again merely because the visible miner has been deleted.
For high-confidence recovery, organizations should consider erasing the affected Mac and reinstalling macOS from a trusted source.
Credentials used on the compromised device should also be rotated from a known-clean machine.
This includes passwords, SSH keys, API tokens, cloud credentials and other secrets that may have been accessible to the attacker.
Why Developers Should Pay Special Attention
Developer machines can contain unusually valuable secrets.
A compromised development Mac may hold Git credentials, cloud-provider tokens, package-manager credentials, SSH keys and configuration files.
The attacker may not care about the Mac itself.
They may care about what the Mac can access.
This creates a potentially dangerous path from a single vulnerable Screen Sharing endpoint into software repositories, cloud infrastructure or internal services.
Hosted Mac Infrastructure Is a Growing Attack Surface
Mac hardware is increasingly used outside traditional desktop environments.
Companies operate remote Mac minis and Mac Studios for mobile application builds, automated testing, CI/CD pipelines and specialized development workloads.
These machines can run continuously and may be managed remotely.
That makes them attractive targets for attackers seeking reliable computing resources.
A vulnerable hosted Mac can therefore become both a cryptomining victim and a valuable infrastructure foothold.
The Incident Shows Why Exposure Matters More Than Intent
Administrators often enable remote services for legitimate reasons.
The security problem begins when convenience outlives its original purpose.
A temporary Screen Sharing configuration can become permanent.
A test machine can become production infrastructure.
A forgotten Mac can remain online for months.
A firewall rule can change during a network migration.
Attackers do not care why a service was exposed. They only care that it is reachable.
What Undercode Say:
- Remote Administration Must Be Treated as Critical Infrastructure
Screen Sharing may look like a desktop convenience feature, but its security implications are closer to those of a server administration interface.
2. Authentication Bugs Are Especially Dangerous
A vulnerability that bypasses authentication removes one of the most fundamental security boundaries.
3. Internet Exposure Multiplies Risk
A vulnerable service reachable only from a trusted management network is a different threat than the same service exposed to the entire internet.
4. Port 5900 Deserves Attention
Organizations should know exactly which assets expose TCP 5900 externally.
5. Root Access Changes Everything
Once attackers achieve root privileges, the incident becomes a full-system security event.
6. Cryptomining Can Hide a Bigger Operation
Mining software can be noisy, but it may not be the attacker’s ultimate objective.
7. Performance Problems Can Become Security Indicators
Unexpected CPU consumption should sometimes be investigated as a potential compromise rather than dismissed as normal system activity.
8. Developers Face Greater Downstream Risk
Development systems often contain credentials capable of accessing additional infrastructure.
9. Hosted Macs Need Continuous Monitoring
Remote Mac fleets should be included in vulnerability-management programs just like Linux and Windows servers.
10. Patching Must Be Verified
Organizations should not assume that an update was installed simply because it was approved.
11. Asset Discovery Is Essential
Security teams cannot protect machines they do not know exist.
12. External Scanning Finds Forgotten Services
Internal configuration reviews do not always reveal what the internet can actually reach.
- VPN Access Is Safer Than Public Exposure
Remote management should generally occur through controlled access paths rather than unrestricted internet connections.
14. IP Allowlisting Can Reduce Attack Surface
Where operationally practical, limiting access to known management addresses can significantly reduce exposure.
15. Security Policies Need Continuous Validation
A secure configuration today may become an exposed configuration tomorrow.
16. Remote Management Should Be Minimized
If nobody needs Screen Sharing, it should not remain enabled.
- Unsupported macOS Versions Are a Strategic Risk
An organization cannot maintain modern security if critical systems are stuck on software that no longer receives fixes.
18. Root Compromise Requires Incident Response
Deleting a miner is not equivalent to restoring trust.
19. Credentials Should Be Rotated
Secrets stored on a compromised system should be considered potentially exposed.
20. Clean Recovery Is Often Safer
For confirmed root-level compromise, rebuilding the machine can provide stronger assurance than attempting to manually remove every malicious component.
21. Logs Can Reveal the Timeline
Security teams should preserve authentication, process and network evidence where possible.
22. Endpoint Protection Still Matters
Security software can provide another detection layer against miners, persistence and malicious activity.
23. Monitoring Should Include Remote Access
Unusual Screen Sharing activity can become an important detection signal.
- The Attack Surface Extends Beyond the Desktop
A Mac can be a gateway to repositories, cloud accounts and internal networks.
- Security Teams Should Hunt Before Alerts Appear
Waiting for an endpoint alert can leave a vulnerable system exposed for too long.
26. Vulnerability Intelligence Must Reach Administrators Quickly
Security advisories are useful only when they translate into operational action.
27. Public Exploitation Changes the Risk Equation
Once working exploitation material exists, defenders should assume attackers can reproduce the technique.
- Security Updates Need Priority Based on Exposure
An internet-facing vulnerable service deserves faster remediation than an isolated workstation.
29. Convenience Should Never Override Network Segmentation
Remote access can remain useful without being publicly accessible.
30. Every Remote Service Needs an Owner
Organizations should know who enabled Screen Sharing and why it remains active.
31. Temporary Exceptions Need Expiration Dates
Security exceptions often become permanent because nobody remembers to remove them.
32. Mac Servers Need Server-Level Security Thinking
A Mac running continuous workloads should be protected like infrastructure, not treated as an ordinary desktop.
33. Cryptocurrency Mining Is an Operational Warning
Unexpected mining activity indicates that unauthorized computation is occurring on the system.
34. Attackers Can Monetize Access Quickly
A compromised machine can begin generating cryptocurrency shortly after exploitation.
- The Real Cost May Be Credential Theft
The value of stolen cloud or development credentials can exceed the cost of the mining operation.
36. Network Visibility Is Critical
Endpoint protection and network monitoring should complement each other.
37. Security Teams Should Assume Secondary Persistence
A successful root exploit gives attackers opportunities beyond the initially observed payload.
- Patching Closes the Door, Not the Investigation
Installing the fix prevents future exploitation but does not prove that a previous compromise never happened.
39. Exposure Management Is Becoming More Important
Modern organizations increasingly operate distributed infrastructure that is difficult to track manually.
40. CVE-2026-65400 Is a Reminder
A simple remote-access feature can become a critical attack surface when authentication fails.
✅ CVE-2026-65400 Is a Real macOS Security Vulnerability
Apple patched the vulnerability in macOS Tahoe 26.6.1, Sequoia 15.7.9 and Sonoma 14.8.9. The issue affects Screen Sharing authentication and can allow unauthorized access.
✅ Active Exploitation Was Reported
NCSC-NL reported exploitation against multiple internet-accessible systems, including incidents where attackers obtained root access and installed Monero mining software.
✅ Internet-Exposed Port 5900 Is a Major Risk Factor
The reported attacks involved systems where Screen Sharing was reachable from the internet. Disabling unnecessary Screen Sharing and restricting remote access substantially reduces exposure.
Prediction
(+1) Patch Adoption Will Accelerate
Organizations running remotely accessible Macs are likely to prioritize CVE-2026-65400 because exploitation has already been observed in the wild.
(+1) Internet-Facing Mac Infrastructure Will Receive More Scrutiny
Security teams are likely to increase scanning for exposed VNC and Screen Sharing services as Mac minis, Mac Studios and hosted Apple infrastructure become more common.
(+1) Cryptojacking Will Remain an Attractive Monetization Method
Attackers can quickly monetize compromised computing resources without immediately triggering the attention generated by destructive ransomware.
(-1) Unpatched Internet-Exposed Macs Will Become Increasingly Difficult to Defend
As technical exploitation knowledge spreads, organizations that leave vulnerable Screen Sharing services publicly reachable will face increasing automated attack pressure.
The Bigger Lesson for Mac Security
CVE-2026-65400 is a powerful reminder that the security of a Mac is not determined solely by whether it is running macOS.
Configuration matters.
Network exposure matters.
Remote-access services matter.
And above all, authentication matters.
A feature that allows an administrator to control a computer remotely effectively becomes a high-value security boundary. If that boundary can be crossed without valid credentials, an attacker does not need to convince a user to open a malicious attachment or click a phishing link.
They simply need to find the exposed machine.
What Mac Administrators Should Do Now
The immediate priority is straightforward: update every supported Mac, identify machines running Screen Sharing, determine whether TCP port 5900 is externally reachable, and disable unnecessary remote-access services.
Organizations should then investigate systems that were exposed during the vulnerable period, particularly if they show unusual CPU activity, unexpected processes, unfamiliar persistence mechanisms or unexplained network connections.
Most importantly, administrators should remember that patching is only half the response.
A patch prevents exploitation. It does not erase evidence of an intrusion that may already have occurred.
For Macs that were successfully compromised at root level, incident response, credential rotation and trusted system recovery should be considered before returning the machine to normal operations.
The attack against Screen Sharing demonstrates how quickly a seemingly ordinary remote-access feature can become a critical security liability. For every administrator running a remotely accessible Mac, CVE-2026-65400 should be treated not as another entry on a long patching list, but as a warning to examine what is exposed, who can reach it and whether the systems behind those services can still be trusted.
▶️ Related Video (86% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: www.bitdefender.com
Extra Source Hub (Possible Sources for article):
https://www.twitter.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
