Attackers are actively exploiting a high-severity authentication flaw in Apple's macOS Screen Sharing service, using it to gain root access to internet-exposed Macs and install Monero cryptocurrency miners.

The Netherlands' National Cyber Security Centre (NCSC) has confirmed active exploitation on multiple systems that had port 5900 exposed to the internet. Users running affected macOS versions are urged to install Apple's August security updates immediately and to avoid exposing Screen Sharing directly to the public internet.

Authentication Bypass Without Valid Credentials

Tracked as CVE-2026-65400, the vulnerability affects the authentication process used by macOS Screen Sharing. Insufficient state management allowed a network-based attacker to authenticate without valid credentials, granting unauthorized access that should have been rejected.

The Dutch NCSC updated its advisory on August 12 after receiving reports of exploitation across multiple systems. Every affected Mac identified in those reports had port 5900 reachable from the internet, and in each case attackers obtained root access and deployed a Monero miner. The agency also confirmed that public proof-of-concept code for the flaw is available. Because root is the highest privilege level on macOS, the unauthorized logins amounted to full control of each affected machine, with the miner serving as the payload observed in the reported incidents. Monero, a privacy-focused cryptocurrency whose RandomX mining algorithm is designed to run efficiently on general-purpose CPUs rather than specialized ASIC hardware, has been a recurring choice in illicit cryptomining campaigns.

CVE-2026-65400 carries a CVSS 3 score of 7.1, placing it in the high-severity category rather than the critical range. Because Apple's Screen Sharing configuration uses TCP port 5900 by default for standard connections, publicly exposed systems become a direct target whenever the vulnerable service is enabled. Screen Sharing is Apple's implementation of the VNC remote-desktop protocol, and security researchers have documented sustained internet-wide scanning of VNC's default port, which makes any open 5900 endpoint readily discoverable by anyone surveying the internet for reachable remote-access services.

Apple Patches Three macOS Versions

Apple patched the Screen Sharing authentication flaw on August 6 with macOS Tahoe 26.6.1. The same correction was released for macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9. The fix strengthens state management during authentication so that Screen Sharing accepts only valid credentials.

Macs that do not require remote screen access should have Screen Sharing disabled, a toggle located in System Settings under General > Sharing, while administrators who rely on the service should prevent port 5900 from being directly reachable from the public internet. Systems that were previously exposed should also be checked for signs of unauthorized access and unexpected processes, particularly cryptocurrency-mining software running with elevated privileges.

macOS Crypto Malware Threats Expand

The exploitation adds another macOS-focused threat to a growing series of attacks involving cryptocurrency infrastructure. A separate campaign uncovered in July used macOS malware to steal Telegram sessions, wallet databases and system credentials before replacing legitimate Ledger and Trezor applications with malicious versions.

Apple devices have also been targeted through software distributed inside official application stores. The SparkKitty malware campaign accessed users' photo libraries in search of wallet recovery phrases and other sensitive information.

Apple has now released fixes for CVE-2026-65400 in macOS Tahoe 26.6.1, Sequoia 15.7.9 and Sonoma 14.8.9 as of August 6, while the Dutch NCSC continues to classify active exploitation of unpatched, internet-exposed systems as known.