In short: Apple released an emergency patch on August 6, 2026 for CVE-2026-65400 — a critical (CVSS 9.8) authentication bypass in macOS Screen Sharing. Attackers can log into a Mac over the network with no password and gain root access. By August 17–18 confirmed real-world attacks had begun deploying Monero cryptocurrency miners. Update macOS now.
What happened
On August 6, 2026 Apple released macOS Tahoe 26.6.1, Sequoia 15.7.9 and Sonoma 14.8.9, closing CVE-2026-65400 — a critical flaw in the macOS Screen Sharing feature. The CVSS severity score is 9.8, placing it in the highest-risk category.
Days after the patch was released the situation escalated. On August 12 a functional public exploit became available. By August 17–18 the Dutch National Cybersecurity Center (NCSC) confirmed active real-world exploitation: attackers had broken into unpatched Macs and installed Monero miners. We covered a similar zero-interaction threat in our breakdown of the Lazarus Winsock zero-day.
How the vulnerability works
macOS Screen Sharing runs on the VNC protocol over TCP port 5900. CVE-2026-65400 is an authentication state-management flaw: an attacker who knows the target account username — which often matches the device name visible on the local network or broadcast via Bonjour — can bypass the password check entirely by sending a few specially crafted network packets.
Exploitation does not require:
- knowledge of the account password;
- physical access to the device;
- any action from the victim (this is not phishing).
All it requires is network-level reachability to port 5900. If a Mac has a public IP or sits on a network where an attacker already has a foothold, the device is at risk regardless of password strength.
What happens after a successful attack
Once authenticated, the attacker receives root privileges — full administrative control. In confirmed cases, attackers used this access to install a Monero (XMR) miner. Monero is favored by criminal actors because its transactions are designed to resist blockchain analysis.
The miner consumes CPU and GPU resources, manifesting as overheating, sluggish performance and high power draw. Victims may not notice for days until the Mac starts running hot or the battery drains abnormally fast on a MacBook.
Whether attacks are limited to mining is unknown. With root access, an attacker can install backdoors, exfiltrate files or activate the camera. Data confidentiality on a compromised machine is effectively zero.
Who is at risk
The immediate risk falls on Macs with Screen Sharing enabled and port 5900 reachable from the internet or an untrusted local network. This includes:
- home servers and media centers on Mac Mini or Mac Pro;
- work Macs configured for remote desktop access by IT teams or managed-service providers;
- Macs on corporate networks where an attacker has already gained a network foothold.
A MacBook behind a home NAT router is less directly exposed — port 5900 is not reachable from the public internet by default. But public Wi-Fi places your Mac in the same segment as potential attackers, and UPnP may silently forward the port.
How to protect yourself
1. Update macOS now. Go to System Settings → General → Software Update. Target versions: Tahoe 26.6.1, Sequoia 15.7.9 or Sonoma 14.8.9. The patch fully closes the vulnerability.
2. If you cannot update immediately — disable Screen Sharing. System Settings → General → Sharing — uncheck Screen Sharing. This immediately closes port 5900 without losing other Mac functionality.
3. Use a VPN on public and untrusted networks. A VPN tunnel encrypts your connection and hides your Mac's real IP address. An attacker on the same Wi-Fi network cannot directly reach your port 5900 — all traffic flows through the encrypted tunnel. The LiMP VPN app already protects your iPhone next to your Mac; the same network-layer protection belongs on your computer in any public space. More on how VPN works on our features page.
4. Check for port exposure. Run in Terminal: sudo lsof -iTCP:5900 — if it returns output, the port is open. More threat breakdowns are in our blog.