macOS Screen Sharing Flaw CVE-2026-65400 Is Being Exploited to Mine Monero on Exposed Macs
The macOS Screen Sharing flaw now carries a CVE, CVE-2026-65400, and NCSC-NL warns it is under active exploitation. Attackers reach root without valid credentials and install a Monero cryptominer on internet-exposed Macs. Apple's fix shipped August 6; patch and close port 5900.
The macOS Screen Sharing flaw that surfaced earlier this month now carries a formal identifier, CVE-2026-65400, and a fresh warning to match. Apple patched it on August 6 in three specific builds, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, and macOS Tahoe 26.6.1, and the Netherlands' National Cyber Security Centre (NCSC-NL) now reports the bug is under active exploitation. Attackers are authenticating to Screen Sharing without valid credentials, gaining root, and installing a Monero cryptominer on Macs left reachable over the internet. We broke down how the authentication bypass works when it first appeared; the detail worth adding now is where the flaw lives.
Here is the sentence to carry into a patch review: CVE-2026-65400 sits in Apple Screen Sharing, which speaks VNC over TCP port 5900, a remote-desktop protocol macOS has bundled since Mac OS X 10.5 Leopard shipped roughly twenty years ago, and the only real fix is the version update. According to the SANS Internet Storm Center, that long lineage is part of what makes the exposure so broad: the service has ridden along in macOS for generations of the operating system, and plenty of machines answer on 5900 without anyone remembering they switched it on.
A Twenty-Year-Old Remote-Desktop Surface
Screen Sharing is the friendly name for Apple's built-in remote desktop. Under the label is VNC, the Virtual Network Computing protocol, listening on TCP port 5900. SANS ISC notes that this pairing has been a fixture of macOS since Leopard in 2007, which means the attack surface is not a new feature bolted on last year but a mature, widely present service. An authentication bypass in a protocol that old reaches an unusually large and varied population of machines: office iMacs, home Macs switched on for occasional remote help, and the quieter category that keeps showing up in the exploitation reports, forgotten Macs running as build agents, media servers, or cloud instances with remote access left open.
The age of the protocol also shapes the fix. Because CVE-2026-65400 is a bypass in the Screen Sharing daemon itself, the familiar VNC hardening steps, rotating the password or trimming the list of approved users, do nothing against it. The bypass happens before those checks apply. That leaves two controls that actually close the hole, and both are binary: install the patched build, or stop exposing TCP port 5900. There is no partial mitigation in between.
What NCSC-NL Is Actually Seeing
The exploitation warning comes from NCSC-NL and was relayed this week by Help Net Security and SecurityWeek. The Dutch agency describes a consistent pattern: an attacker on the network path authenticates to Screen Sharing without any valid macOS account or VNC password, is handed a session, escalates to root, and installs a Monero cryptocurrency miner. In the cases reported to NCSC-NL, every compromised Mac had port 5900 exposed to the internet, which lines up with the mechanics. An exposed port plus an unpatched build is the entire attack.
Two things are worth holding at arm's length, because the current reporting does not pin them down. No specific victim organizations have been named, and the exact mining pool the payload connects to has not been published. Those gaps do not change the response, but they are the kind of detail that tends to firm up over the following days, so treat any single-source specificity with the usual caution.
Why a CPU-Friendly Coin Fits Exposed Macs
The choice of Monero is not incidental. Its proof-of-work algorithm is tuned for general-purpose processors rather than specialized mining hardware, which makes an ordinary Mac's CPU worth hijacking. That economics is why opportunistic crews scan the internet for anything answering on 5900 in the first place: each unpatched, exposed Mac is a small, free processor they can rent out to themselves. The payoff is quiet by design, which is what makes the detection guidance matter.
For defenders, the cryptominer leaves a recognizable trail even when the intrusion is silent. Watch for unexplained, sustained CPU load on a Mac that should be idle, and for outbound connections to mining-pool infrastructure that have no business originating from a workstation or a build server. Treat that combination as a compromise to investigate rather than a performance quirk to reboot away, because on a machine that was exposed during the window, patching afterward stops future entry but does nothing about a miner already running.
The shape of this campaign, real-world attacks landing on unpatched systems days after a fix ships, is the recurring story of the month rather than a one-off. It matched the VMware vCenter and SharePoint flaws that came under attack within a week of their patches, and it echoes the actively exploited afd.sys zero-day in August's Patch Tuesday. Publish, patch, and race the attackers to the update: the macOS case fits the same pattern, and the machines that lag are the ones that get taken.
On severity, the live picture has moved since the fix shipped. The flaw first carried a CVSS base score of 7.1, but on August 14 CISA raised its assessment to 9.8, near the top of the scale, after judging the attack automatable and network-reachable to root without authentication. As of this writing, CVE-2026-65400 has not been confirmed as added to CISA's Known Exploited Vulnerabilities catalog, though active exploitation is exactly the condition that leads to a listing. Either way, the jump from 7.1 to 9.8 is the reminder worth keeping: a flaw's real weight is set by whether it is being used, not by its opening number.
2. Disable Screen Sharing where it is not needed (System Settings, General, Sharing).
3. Block TCP port 5900 at the perimeter so the service is not reachable from untrusted networks.
4. Hunt for cryptominer telemetry: unexplained sustained CPU load and outbound connections to mining pools.
My Read
My read: the frightening framing, root on a Mac with no password, is accurate, and the reassuring part is that the fix is unusually clean. This is not a stealthy chained exploit; it is a single pre-authentication bug in a twenty-year-old service, with an official update already available and one clear network precondition. If a Mac is on the August 6 build for its line, or if nothing on your address space answers on 5900 from the internet, this campaign has nothing to grab. The population genuinely at risk is narrow and predictable: home users and small shops who switched on Screen Sharing for convenience and left it reachable, plus the forgotten fleet Macs that no one is patching. For teams, this is inventory-and-confirm work, not a fire drill: verify patch levels through your MDM, scan your own space for anything exposing 5900, and watch for the cryptominer's CPU tell. The lesson that outlives this one bug is the move from 7.1 to 9.8. Severity is not fixed at disclosure, and the deciding input is whether someone is firing the exploit right now.
