CVE-2026-65400: Improper Authentication for macOS screensharing

Threat Intel
, , , , ,
1

Last Updated: 2026-08-20T15:56:43Z

CVSSv3.1: 9.8

What’s Happening

An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.

Vendor advisories:

Technical analysis by Huntress with some analysis of public PoCs & potential methods to detect it:

From Screen Share to Root Access: Breaking Down CVE-2026-43760 and CVE-2026-65400 on macOS | Huntress.

This really isn’t a new vulnerability (a few weeks now) but it got added to CISA KEV yesterday & I suspect exploitation started happening already at least around August 10th (this would match the NCSC NL report from the 12th, NCSC NL | Security Advisories ). If you or your org have some internet-facing Macs with screenshare enabled & all that I’d definitely check on them.

Actions

Patch all affected systems and watch for suspicious activity for any machine that had screen sharing enabled.

Indicators

IFIN has received anonymous confirmation of in-the-wild exploitation. The activities included attempted installation of the XMRig cryptominer. Log files were deleted to attempt to cover the attackers’ tracks. The indicators will be in our MISP feed.

3 Likes
2

Moved to Threat Intel with EITW confirmation.

3

If you happen to be a Tanium shop, they released a dashboard last night to report on Mac screensharing status with a screensharing disable package.

https://{tenant}.cloud.tanium.com/ui/reporting/dashboards/dashboard?id=dashboard-cve-2026-65400-apple-mac-os-improper-authentication-vulnerability

The SANS article notes the disable command, but you’ll want to use bootout or reboot to take effect.

launchctl disable system/com.apple.screensharing 2>&1
launchctl bootout system/com.apple.screensharing 2>&1
launchctl print system/com.apple.screensharing 2>&1

print should fail when the other commands are successful. You’ll need sudo or a service account (MDM/EDR) that’s already running high priv.

1 Like