Overview
- Apple released an out‑of‑band patch on August 6 that fixes an authentication and state‑management bug in the built‑in Screen Sharing service tracked as CVE‑2026‑65400.
- The Netherlands’ NCSC updated its advisory on August 12 to confirm multiple internet‑reachable Macs with port 5900 exposed were rooted and fitted with Monero mining software.
- Public proof‑of‑concept code and a Black Hat demonstration have lowered the bar for attackers and prompted CISA to raise the vulnerability’s CVSS score to 9.8 and mark it automatable.
- The flaw lets attackers bypass authentication before normal login, so changing Screen Sharing passwords or disabling legacy VNC authentication does not stop exploitation and only Apple’s patch or disabling the service will protect a Mac.
- Security scans found tens of thousands of potentially exposed Macs, especially hosted bare‑metal instances, so organizations should block TCP 5900 at network edges, inventory internet‑reachable Macs, apply updates, and hunt for signs of compromise like persistent miners.