The macOS Screen Sharing exploit behind CVE-2026-65400 is being actively used in the wild to compromise machines and silently install a Monero cryptocurrency miner, according to the Netherlands’ National Cyber Security Centre (NCSC). It is, by any measure, the sort of vulnerability that rewards attackers who do their homework: a network-accessible authentication bypass requiring no valid credentials, on a feature that ships switched on for many users.
What the macOS Screen Sharing exploit does
Screen Sharing is a built-in macOS remote desktop capability that operates via the VNC protocol over TCP port 5900. The flaw allows a network-based attacker to gain access to a system without supplying valid credentials. From there, an attacker can open applications remotely, access files, alter security settings, and carry out a range of other actions.
The Hacker News reports that the vulnerability was discovered and reported by security researcher Alfredo Pesoli of Bynario. Apple patched it on 6 August in macOS Tahoe 26.6.1 and in earlier supported releases. Public exploit code appeared shortly after, and the NCSC confirmed it began receiving reports of active exploitation targeting systems with port 5900 exposed to the internet.
In those cases, according to the NCSC’s own update, attackers obtained root access and deployed a Monero miner. ‘The NCSC has received a notification indicating that active abuse of this vulnerability has been observed on multiple systems on which port 5900 was accessible from the Internet,’ the agency stated. ‘In all these cases, root had been accessed on the affected system, and a Monero crypto miner had been placed.’
Why Monero, and why this vulnerability fits
The choice of Monero is not accidental. As Malwarebytes explains, Monero mining does not depend on heavily specialised, application-specific integrated circuits (ASICs): it can be carried out on any CPU or GPU. That makes a compromised Mac, with root access already secured, a perfectly serviceable mining node. No specialist hardware required, no conspicuous purchase trail, and the miner can run quietly in the background for as long as the owner remains unaware.
The authentication bypass hands attackers root privileges without a fight, which means the miner can be dropped and configured with minimal friction. Whether the attackers’ ambitions extend beyond cryptocurrency mining is, as yet, unknown: the NCSC has not shared details about when the attacks began, how many systems have been affected, or whether any other payloads were observed alongside the miner.
There is also a wider pattern worth noting. According to TechTimes, CVE-2026-65400 is the second Screen Sharing vulnerability of consequence that Apple has patched in 2026, following CVE-2026-43760 in late July. Two significant flaws in the same component within weeks of each other is the kind of pattern that tends to attract sustained attention from researchers and attackers alike.
Patching and interim mitigations
Apple’s fix is available across three macOS releases. Users should upgrade to one of the following:
macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, or macOS Sonoma 14.8.9. The updates improve state management to enforce correct credential validation and block rogue authentication attempts.
Where an immediate update is not practical, Screen Sharing can be disabled via System Settings: General, then Sharing, then Screen Sharing. If you are not actively using it, there is no good reason to leave port 5900 exposed, particularly to the open internet.
The broader post-access picture is uncomfortable regardless of this specific flaw. The Blue Report 2026, which measured defences across 338 million simulations run in customer production environments, found that once attackers are operating with valid credentials, only 37% of their subsequent actions are blocked. An authentication bypass that hands an attacker root access from the start skips the credential step entirely, making that already sobering figure look generous.
The NCSC advisory remains active, and Apple’s patches are available now for all three supported macOS versions.
