6 min read
By: RedLegg's Cyber Threat Intelligence Team
About:
CVE-2026-65400 is a critical authentication bypass vulnerability affecting the Screen Sharing service in macOS.
The flaw exists in screensharingd, the daemon that provides remote desktop access over the VNC protocol. Due to an error in the implementation of Secure Remote Password (SRP) authentication, an attacker on the network can establish an authenticated Screen Sharing session without valid credentials. The resulting session also continues without cryptographic protection.
Successful exploitation allows unauthorized remote access to affected macOS systems. Apple has confirmed that CVE-2026-65400 is actively exploited in the wild.
RedLegg will occasionally communicate vulnerabilities released outside the usual release schedule to provide additional value to our customers. These emergency bulletins describe vulnerabilities or threats we classify as the highest severity level and warrant out-of-band emergency patching or mitigation action.
VULNERABILITIES
Pre-Authentication Bypass in macOS Screen Sharing
Identifier: CVE-2026-65400
PoC or Exploitation:
Confirmed actively exploited in the wild.
CVSS Score: 9.8 (Critical, CVSS v3.1)
Update / Patch:
Apple has released fixed versions addressing this vulnerability.
Affected versions include:
- macOS Sequoia, prior to 15.7.9
- macOS Sonoma, prior to 14.8.9
- macOS Tahoe, prior to 26.6.1
Fixed versions include:
- macOS Sequoia 15.7.9
- macOS Sonoma 14.8.9
- macOS Tahoe 26.6.1
If immediate patching is not possible, disable Screen Sharing under System Settings, General, then Sharing, and ensure TCP port 5900 is not reachable from the internet.
Apple advisory and patch guidance:
Description:
CVE-2026-65400 is an authentication bypass vulnerability in screensharingd, the daemon behind macOS Screen Sharing, which provides remote desktop access over the VNC protocol on TCP port 5900.
The vulnerability stems from an error in the Screen Sharing service's implementation of Secure Remote Password authentication. The daemon's frame-length validator incorrectly returns a stale success status, causing a connection to be treated as authenticated when it is not. The resulting session also continues without cryptographic protection.
An attacker on the network can exploit this flaw to authenticate to Screen Sharing without valid credentials, without needing to know a configured VNC password or possess a local macOS user account.
Mitigation Recommendation:
Apply the applicable fixed version for your macOS release immediately.
If immediate patching is not possible, disable Screen Sharing under System Settings, General, then Sharing.
Ensure TCP port 5900 is not exposed to the internet.
Review systems for indicators of compromise consistent with cryptomining activity, including unexpected high CPU utilization, unfamiliar scheduled tasks or cron jobs, and unrecognized processes running with root privileges.
