Full Report
Apple’s latest macOS update addresses two vulnerabilities in its Screen Sharing server, including one that enables pre-authenticated remote code execution.
Analysis Summary
# Vulnerability: macOS Screen Sharing Pre-Auth Remote Code Execution
## CVE Details
- **CVE ID**: CVE-2026-65400 (Primary), CVE-2026-43760 (Related)
- **CVSS Score**: Not explicitly listed in text, but categorized as "Significant Consequence/Critical" (Estimated 9.8+ for Pre-Auth RCE)
- **CWE**: Improper Implementation of Secure Remote Password (SRP) / Confused Deputy
## Affected Systems
- **Products**: Apple macOS (Screen Sharing service)
- **Versions**:
- macOS Tahoe (v26) prior to 26.6.1
- macOS Sequoia (v15) prior to 15.7.9
- macOS Sonoma (v14) prior to 14.8.9
- **Configurations**: Systems where **Screen Sharing** or **Legacy VNC authentication** is enabled, particularly those exposed to the public internet or untrusted networks.
## Vulnerability Description
The primary flaw (CVE-2026-65400) exists in the Screen Sharing service's implementation of the **Secure Remote Password (SRP)** protocol. This flaw allows an attacker to bypass authentication requirements entirely.
A related vulnerability (CVE-2026-43760) involves a confused-context condition in the privileged user helpers `SSFileCopySender` and `SSFileCopyReceiver`. While the latter originally required an authenticated session, the combination of these flaws or the SRP bypass allows an attacker to execute code as `root` without valid credentials.
## Exploitation
- **Status**: PoC available (Public disclosures and flurry of activity reported as of August 2026).
- **Complexity**: Low (Described as "significant consequence" and "easy to confuse" with simpler authenticated bugs).
- **Attack Vector**: Network (Remote).
## Impact
- **Confidentiality**: High (Full access to desktop and filesystem).
- **Integrity**: High (Ability to create/modify filesystem artifacts as `root`).
- **Availability**: High (Full system control).
## Remediation
### Patches
Apple released comprehensive patches on August 6, 2026. Users should update to the following builds or later:
- **macOS Tahoe**: 26.6.1
- **macOS Sequoia**: 15.7.9
- **macOS Sonoma**: 14.8.9
### Workarounds
- **Disable Screen Sharing**: Turn off Screen Sharing in System Settings if not strictly necessary.
- **Restrict Access**: If the service is required, ensure it is not exposed to the public internet. Use a VPN for remote access.
- **Disable Legacy VNC**: Disable the "VNC viewers may control screen with password" option to reduce the attack surface of privileged helpers.
## Detection
- **Indicators of Compromise**:
- Unexpected connections to the RFB/VNC port (default 5900).
- Unexplained activity by `SSFileCopySender` or `SSFileCopyReceiver` processes.
- Presence of unauthorized files created with `root` privileges.
- **Detection Methods**: Monitor system logs for SRP authentication anomalies or crashes in the Screen Sharing daemon (`screensharingd`).
## References
- Apple Security Advisory (August 2026)
- Huntress Blog: hxxps[://]www[.]huntress[.]com/blog/macos-screen-sharing-rce-patched
- Bynar.io Research: hxxps[://]bynar[.]io/blog/a-root-remote-command-execution-on-macos-with-m5-in-2026
- Apple Support - Screen Sharing Guide: hxxps[://]support[.]apple[.]com/en-au/guide/mac-help/mh11848/mac