macOS Screen Sharing Auth Bypass Exploited in the Wild to Mine Monero

If your Mac runs Screen Sharing and port 5900 is reachable from the internet, stop reading and go patch it. Or turn it off. I'll wait.

CVE-2026-65400 is a critical authentication bypass in macOS Screen Sharing, Apple's built-in VNC remote desktop service. CVSS 9.8. A network attacker can authenticate without valid credentials. Apple shipped fixes on August 6 in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9.

The Netherlands NCSC warned this week that the flaw is being actively exploited. Every reported case follows the same shape: a Mac with port 5900 exposed, an attacker who reached root, and a Monero miner dropped on the system.

Not a foothold. Root. Anonymous network access straight to a crypto miner, no user interaction anywhere in the chain.

Researcher Alfredo Pesoli of Bynario found and reported the bug, then published details on a cluster of related Screen Sharing flaws Apple fixed in the same wave. CVE-2026-43779 is a logic issue that lets an app intercept another process's network connections (CVSS 9.8). CVE-2026-43777 is a remote denial of service (7.5). CVE-2026-43760 is an access issue (8.6).

The last one is the interesting one. It lives in a legacy Screen Sharing auth path, the "VNC viewers may control screen with password" option. Pesoli's write-up shows how a file copy operation turns into protected file disclosure, arbitrary root file creation, and remote root command execution. It requires the attacker to already hold the VNC password, which sounds reassuring until you remember how VNC passwords actually get used. One shared password for a whole fleet, set once in 2019, never rotated.

The practical list:

If you don't use Screen Sharing, disable it. System Settings, General, Sharing, Screen Sharing. A feature that's off can't be exploited.

If you do use it, keep port 5900 off the public internet. VPN, or Apple Remote Management with locked-down access controls. "It's just for the admin" is how these boxes end up in botnets.

Patch. Tahoe 26.6.1, Sequoia 15.7.9, Sonoma 14.8.9. Apple does not ship emergency point releases for fun.

What gets me about this one is the payload. Attackers aren't stealing data or staging ransomware. They're farming compute on boxes left with a door open, and that tells you this is running at scale against anything with 5900 reachable. The patch has been out since August 6 and the NCSC is still seeing fresh infections.

Check your exposed ports. This only stops when people stop leaving VNC on the internet.