Apple's quiet Screen Sharing fix is now a same-day job: CVE-2026-65400 is under active abuse

Apple shipped macOS Sonoma 14.8.9, Sequoia 15.7.9 and Tahoe 26.6.1 earlier this month behind release notes that said only that they contained important security fixes recommended for all users ^[1]. The bug those updates closed, tracked as CVE-2026-65400, is now being exploited: the Netherlands National Cyber Security Centrum said earlier this week that it had been notified of active abuse on multiple systems where port 5900 was reachable from the internet, and that in every case root was obtained and a Monero crypto miner planted ^[3][4].

Apple's expanded advisory is two lines: an attacker on the network may be able to authenticate to Screen Sharing without valid credentials, and the underlying authentication issue was addressed with improved state management ^[2]. Ars Technica puts the severity at 7.1 out of 10 and describes the root cause as a flaw in the state management that tracks preceding events, user interactions and variables ^[3][7]. Screen Sharing lets a remote party view the screen and drive the keyboard and mouse on a running machine ^[6], which 9to5Mac notes gives an attacker roughly what physical possession of a logged-in Mac would ^[10].

Two details make this a different kind of patch cycle than the release notes implied. First, Apple said at the time of release that there was no evidence of exploitation in the wild ^[5], and that statement is now stale. Second, the details of the vulnerability became public at Black Hat last week ^[8], and the NCSC notification came within days ^[4] - roughly a week between public disclosure and observed root-level compromise ^[14]. Ars Technica also reports that video of the exploit in action is available ^[12], and that Apple hedged with language saying the flaw "may" allow an uncredentialed attacker in, which Ars calls common softening in vendor disclosures ^[9].

Apple's phrase "an attacker on the network" reads differently against the reported cases, where the affected hosts had 5900 exposed to the open internet ^[13]. That is the practical scoping question for a fleet: not just which Macs are unpatched, but which ones answer on 5900 from outside. The identical payload across multiple victims points to scanning-driven opportunism rather than targeting ^[16], which means exposure alone is the qualifying criterion. Screen Sharing is toggled under System Settings > General > Sharing, and 9to5Mac's advice is to enable it only for the duration of a session and switch it off afterwards ^[11].

What to watch: whether other national CERTs confirm abuse independently of the NCSC report, which is currently the single source for exploitation ^[4]; whether observed payloads move past mining toward credential theft, which 9to5Mac flags as the obvious next step ^[15]; and whether Apple restates the advisory now that the no-evidence line from release week no longer holds ^[5].