Attackers are actively exploiting a critical authentication flaw in macOS Screen Sharing, tracked as CVE-2026-65400, against systems with port 5900 directly exposed to the internet. According to Dutch authorities, some compromised machines have been converted into Monero miners. Apple has responded with emergency security patches spanning macOS Tahoe, Sequoia, and Sonoma.

A critical authentication flaw in macOS Screen Sharing is leaving Apple devices exposed to unauthorized exploitation. The flaw allows attackers to bypass authentication and gain unauthorized administrative access by hijacking administrative access through the vulnerable desktop environment. Dutch authorities say some attackers have used compromised systems to deploy Monero mining software, and security experts recommend installing Apple’s emergency updates immediately to avoid resource hijacking or serious performance issues.

Critical macOS Vulnerability Enables Unauthorized Monero Mining

Tracked as CVE-2026-65400, the flaw carries a critical CVSS severity rating of 9.8, placing it near the top of the 10-point scale used to rank software vulnerabilities. Specifically, the bug relates to state management in the authentication system on the native Screen Sharing service, an Apple implementation of the VNC remote-desktop protocol that by convention listens on TCP port 5900.

Screen Sharing ships disabled by default on macOS, so the exposed population consists of machines where users or administrators deliberately enabled the service and whose networks leave port 5900 reachable from the open internet.

Remote threat actors exploit this logic error by sending crafted packets directly to vulnerable machines. As a result, once they gain access, hackers have full administrative control even if they do not know the system password or logon username.

Attackers can use the elevated access to deploy malware, including cryptojacking software that installs stealthy Monero mining scripts. These rogue operations also consume hardware resources while running in the background as system processes.

The campaign was flagged publicly on X by news outlet BSCN, quoting Dutch authorities:

Apple Mac Flaw Lets Hackers Turn Devices Into Monero Miners

Hackers exploited a flaw in Apple’s Screen Sharing feature to take control of internet reachable Macs. The attackers then installed Monero monero:native mining software on compromised devices, Dutch authorities said.… pic.twitter.com/36IjOoiLay

— BSCN (@BSCNews) August 17, 2026

Understanding Port 5900 Exploitation and Monero Mining Mechanics

The exploit targets devices running port 5900 that are directly exposed to the open internet, and automated scanning tools can detect accessible targets in minutes across a global network range, leaving exposed, unpatched machines readily discoverable. The attack surface is familiar to defenders: internet-facing remote-access and remote-desktop services have repeatedly dominated government cybersecurity agencies’ annual advisories on the most routinely exploited vulnerabilities, and Macs left reachable on standard ports draw the same opportunistic attention as any other platform.

Cybercriminals are opting for this privacy-focused cryptocurrency in opportunistic campaigns because they understand how Monero is mined. Unlike Bitcoin, Monero uses the proof-of-work algorithm RandomX, which is suitable for the common desktop CPU. RandomX is also optimized for Apple Silicon and modern x86 CPU architectures, meaning Mac equipment can mine and deliver high hash rates without needing special mining rigs.

Furthermore, Monero uses ring signatures and stealth addresses to hide transaction details entirely. As a result, bad actors can steal computing power while staying hidden from financial regulators.

Apple Security Updates Mitigate Unauthorized Monero Mining

Apple reacted quickly and issued emergency security patches for all supported OS versions. The patches are available in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9, and are documented on Apple’s official security releases page.

Network administrators should check firewalls to ensure port 5900 is closed to external traffic. Alternatively, turning off Screen Sharing in System Settings disables any potential network attack immediately.

Applying the updates closes the Screen Sharing vulnerability and helps prevent this attack path from compromising corporate networks. Overall, patch deployment saves important hardware resources from automated attack campaigns. Because the rogue miners run as background system processes, machines that may have been exposed before patching can be checked in Activity Monitor for sustained, unexplained CPU load — a result consistent with the resource consumption described by researchers.

Monero’s selection is intentional. The cryptocurrency has long been a target of cryptojacking, which involves running mining software on hijacked computers, because the token can be mined on ordinary hardware rather than specialized rigs and because of the private nature of its transactions.