Full Report
The Netherlands' National Cyber Security Centre (NCSC) is warning that hackers are actively exploiting a macOS authentication bypass vulnerability after public exploit code emerged. [...]
Analysis Summary
# Vulnerability: macOS Screen Sharing Authentication Bypass
## CVE Details
- **CVE ID:** CVE-2026-65400
- **CVSS Score:** Not explicitly listed (Assessed as High/Critical based on remote unauthenticated access)
- **CWE:** Improper State Management (Authentication Bypass)
## Affected Systems
- **Products:** Apple macOS
- **Versions:**
- macOS Tahoe versions prior to 26.6.1
- macOS Sequoia versions prior to 15.7.9
- macOS Sonoma versions prior to 14.8.9
- **Configurations:** Systems with "Screen Sharing" or VNC capabilities enabled and exposed to the network (specifically TCP port 5900).
## Vulnerability Description
The flaw exists in the macOS Screen Sharing feature, which utilizes the VNC protocol. Due to a failure in state management mechanisms during the authentication handshake, the system fails to correctly enforce credential validation. This allows a remote attacker to bypass the authentication process and gain unauthorized desktop control over the network.
## Exploitation
- **Status:** Exploited in the wild; Proof-of-Concept (PoC) code is publicly available.
- **Complexity:** Low (Public exploit code exists).
- **Attack Vector:** Network (Targeting port 5900).
## Impact
- **Confidentiality:** High (Full access to files and applications).
- **Integrity:** High (Ability to modify security settings and install unauthorized software).
- **Availability:** Medium to High (System resources consumed by unauthorized processes like miners).
## Remediation
### Patches
Apple has released the following security updates to address this vulnerability:
- **macOS Tahoe 26.6.1**
- **macOS Sequoia 15.7.9**
- **macOS Sonoma 14.8.9**
### Workarounds
- **Disable Screen Sharing:** If updates cannot be applied immediately, navigate to **System Settings > General > Sharing** and toggle **Screen Sharing** to "Off."
- **Network Filtering:** Ensure port 5900 is not exposed to the internet. Restrict VNC traffic to trusted internal networks or via a VPN.
## Detection
- **Indicators of Compromise:**
- Presence of unauthorized Monero (XMR) cryptocurrency mining software.
- Unexpected "root" user activity or logins.
- High CPU utilization from unknown processes.
- **Detection Methods:**
- Monitor network logs for suspicious inbound traffic on TCP port 5900 from external or untrusted IP addresses.
- Audit system "Sharing" settings to ensure unauthorized remote access is not enabled.
## References
- **Apple Security Advisory:** hxxp://support[.]apple[.]com/en-us/148170
- **NCSC-NL Advisory:** hxxp://advisories[.]ncsc[.]nl/2026/ncsc-2026-0280[.]html
- **News Coverage:** hxxps://www[.]bleepingcomputer[.]com/news/security/hackers-exploit-macos-screen-sharing-flaw-to-deploy-monero-miner/