A Mac With Port 5900 Open Is Not a Patch Ticket, It Is an Incident

The Netherlands National Cyber Security Centrum has warned that a high-severity macOS flaw, CVE-2026-65400, is being actively exploited to run attacker code on affected systems ^[1][12]. The bug sits in macOS screen sharing and lets a remote attacker take control of a Mac when port 5900 is reachable from the internet ^[2][3], and the abuse the NCSC says it observed ended in root privileges and installed Monero miners ^[5]. That combination means every exposed host needs to be treated as compromised, not queued for an update.

Apple shipped fixes for macOS Tahoe, Sequoia and Sonoma last week, according to the reporting ^[4]. The CVE carries a severity rating of 7.1 out of 10 ^[6], which is a fair score for the class of bug and a poor description of the outcome: the observed result is root-level code execution on the machine, which is as far as an attacker needs to go ^[11]. Once that has happened, installing the patch replaces the vulnerable code path. It does not enumerate or remove anything the intruder already placed on the disk with root ^[9].

The payload seen so far is the cheapest thing an attacker can do with root. Coin mining monetises stolen compute and nothing else, and the same access supports much worse: security experts cited in the reporting flag a significant risk that attackers use this vulnerability to deploy malware for credential theft or other purposes ^[7]. Mining is also the noisiest option, which is a small mercy for defenders. It is not a guarantee that mining is all that was dropped. Anything readable on that host, including stored credentials, tokens and keys, should be treated as known to whoever had root ^[10].

So the practical sequence for anyone running a Mac that answered on 5900 is not one step but three. Patch, because the entry path has to close ^[4]. Then confirm the port is not exposed at all and turn off screen sharing when it is not in use, with VPN or SSH tunnelling used instead when remote access is genuinely needed ^[8]. Then rotate whatever secrets lived on the machine and go looking for what was left behind, on the assumption that a miner running as root was not the intruder's only option ^[5][10].

A note on who is exposed here. Screen sharing on 5900 is rarely a deliberate architectural decision. It is a checkbox someone ticked to fix a support problem, plus a router that forwarded the port, plus a Mac that has been quietly reachable ever since. Those hosts are not in a managed fleet inventory, they are under a desk in a branch office, and they will not be found by asking who patched. They will be found by scanning your own ranges for 5900.

What to watch: whether the NCSC or Apple publish indicators of compromise, which would move this from an assumption of compromise to something a team can actually verify; and whether the payload mix shifts away from Monero mining toward credential theft, which the sources cited in the reporting already anticipate ^[7]. Mining campaigns are usually the first wave over a newly exploitable population, not the last. The population here is defined entirely by an open port ^[3], so the cleanup metric worth tracking internally is not patch coverage. It is how many of your own addresses still answer on 5900.