macOS Screen Sharing Flaw Exploited to Mine Monero

The Netherlands' National Cyber Security Centre (NCSC) has reported that an authentication-bypass vulnerability in macOS is already being actively exploited — after exploit code appeared in the public domain.

The problem lies in the Screen Sharing component, the built-in remote desktop access tool that runs over the VNC protocol on top of TCP port 5900. The flaw, assigned the identifier CVE-2026-65400, lets a network-based attacker gain access to the system without valid credentials. With that access, an attacker can remotely launch applications, read files, change security settings and perform other actions.

What's happening in real-world attacks

Apple patched the vulnerability on August 6 in macOS Tahoe 26.6.1 and earlier releases. However, as an updated advisory from the Dutch agency notes, a report has come in of the flaw being exploited “in the wild” on systems whose port 5900 was exposed to the internet.

According to the NCSC, in every observed case the attackers gained root privileges on the compromised machine and installed a miner for the Monero cryptocurrency. “The NCSC has received notification that active abuse of this vulnerability has been observed on several systems with port 5900 accessible from the internet,” the agency's statement reads.

The agency has not disclosed details about the attacks: it is unknown when they began, whether the activity is limited to covert mining, and how many systems were affected.

What users should do

macOS users are advised to update to one of the versions in which the vulnerability has been fixed:

• macOS Tahoe 26.6.1
• macOS Sequoia 15.7.9
• macOS Sonoma 14.8.9

These builds improve state-management mechanisms that ensure credentials are validated correctly and block spoofed authentication attempts. If updating immediately isn't possible and the remote access feature isn't needed, it's wise to disable Screen Sharing through System Settings (General → Sharing → Screen Sharing).

Source: Bleeping Computer