macOS Flaw CVE-2026-65400 Actively Exploited
Critical macOS Flaw (CVE-2026-65400) Actively Exploited to Install Cryptominers
CVE Identifiers
Full Report(when first published)
Executive Summary
A critical vulnerability in Apple's macOS, tracked as CVE-2026-65400, is under active exploitation by threat actors. The flaw is an authentication bypass in the native Screen Sharing feature, which allows a remote, unauthenticated attacker to gain full root-level control of a vulnerable Mac. The U.S. CISA has elevated the vulnerability's severity score to a critical 9.8 on the CVSS scale following confirmation of in-the-wild attacks. Attackers are scanning for and compromising Macs with the VNC port (5900) exposed to the internet, deploying Monero cryptomining malware post-exploitation. Apple has released patches, and immediate action is required to mitigate this threat.
Vulnerability Details
- CVE ID: CVE-2026-65400
- CVSS Score: 9.8 (Critical)
- Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
The vulnerability resides in the authentication mechanism of the macOS Screen Sharing service, which uses the VNC protocol. Due to insufficient state management, an attacker can bypass the authentication process entirely and gain direct access to the system's desktop environment. As the Screen Sharing service can run with high privileges, this access can be immediately escalated to root, giving the attacker complete control over the device.
Affected Systems
The vulnerability affects multiple versions of macOS. Apple released patches on August 6, 2026, for the following versions and later:
- macOS Tahoe 26.6.1
- macOS Sequoia 15.7.9
- macOS Sonoma 14.8.9
Any Mac running an older version with Screen Sharing or Remote Management enabled and exposed to the network (especially the internet) is considered vulnerable.
Exploitation Status
The Dutch National Cyber Security Centre (NCSC-NL) and CISA have confirmed that CVE-2026-65400 is being actively exploited in the wild. The attacks observed involve mass scanning for Macs with TCP port 5900 open. Once a vulnerable host is found, the attackers use the exploit to gain root access (T1068 - Exploitation for Privilege Escalation) and then deploy malware. The current payload is a Monero cryptominer, a form of T1496 - Resource Hijacking.
Impact Assessment
While the current payload is cryptojacking malware, which primarily impacts performance and energy consumption, the underlying access is far more dangerous. Full root access allows an attacker to:
- Steal any data on the device, including sensitive documents, passwords from keychains, and browser data.
- Install persistent backdoors, spyware, or ransomware.
- Use the compromised Mac as a pivot point to attack other devices on the internal network.
- Capture keystrokes, audio, and video from the user.
The ease of exploitation (no authentication needed) and the level of access gained make this a critical threat to all exposed, unpatched Macs.
Cyber Observables — Hunting Hints
The following patterns may help identify vulnerable or compromised systems:
port5900process_namescreensharingdscreensharingd process.process_namexmr-stak, xmrig, c3pool_minercommand_line_patternHigh CPU usage by unexpected processesDetection Methods
- Vulnerability Scanning: Use a vulnerability scanner to identify Macs on your network that are running vulnerable versions of macOS and have port
5900open. - Network Monitoring: Monitor firewall and NetFlow logs for any inbound connections to port
5900from the public internet. This configuration is highly discouraged and should be investigated immediately. This aligns with D3FEND'sNetwork Traffic Analysis (D3-NTA). - Endpoint Monitoring (EDR): Deploy an EDR solution to monitor for signs of post-exploitation, such as the creation of suspicious processes (especially cryptominers), unexpected network connections from system processes, or modifications to system files.
Remediation Steps
- Patch Immediately: The most important step is to update all Macs to the latest patched version of macOS (Tahoe 26.6.1, Sequoia 15.7.9, Sonoma 14.8.9, or newer). This is the primary mitigation, aligning with
M1051 - Update Software. - Disable Screen Sharing: If patching is not immediately possible, disable Screen Sharing and Remote Management in
System Settings > General > Sharing. This is a critical compensating control, mapping toM1042 - Disable or Remove Feature or Program. - Firewall Configuration: Ensure that host-based and network firewalls are configured to block all inbound traffic to TCP port
5900from untrusted networks. Access to Screen Sharing should be restricted to internal management subnets or through a VPN, as perM1035 - Limit Access to Resource Over Network.
Timeline of Events
Article Updates
August 17, 2026
Public PoC exploit for CVE-2026-65400 released, accelerating widespread cryptomining attacks and increasing risk of more severe payloads.
Update Sources:
MITRE ATT&CK Mitigations
Update Software
Immediately apply the security updates provided by Apple to all vulnerable macOS devices.
Mapped D3FEND Techniques:
If patching is not possible, disable the Screen Sharing and Remote Management services as a critical compensating control.
Mapped D3FEND Techniques:
Block inbound access to TCP port 5900 at the network perimeter. Access should only be allowed from trusted internal networks or via VPN.
Mapped D3FEND Techniques:
Timeline of Events
Apple releases out-of-band security updates to patch CVE-2026-65400.
Reports emerge confirming active exploitation of the vulnerability in the wild.
CISA updates the CVSS score for CVE-2026-65400 to 9.8 (Critical).
Sources & References(when first published)
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.