macOS Screen Sharing bug exploited in the wild: if port 5900 was open, assume root was taken

The Dutch National Cyber Security Centre has confirmed active exploitation of CVE-2026-65400, a CVSS 9.8 authentication bypass in macOS Screen Sharing, less than two weeks after Apple shipped the fix ^[1]. In every case NCSC-NL has documented so far, the attacker obtained root on the affected system and dropped a Monero cryptocurrency miner ^[2], which moves the operational question from whether your Macs are patched to whether port 5900 was reachable from the internet while they were not.

Apple's advisory states the impact without decoration: "An attacker on the network may be able to authenticate to Screen Sharing without valid credentials" ^[3]. NCSC-NL is more specific about the mechanism, describing insufficient state management during the authentication process, which allows unauthorized parties to perform authentication attempts that would normally not be accepted ^[4]. Apple's fix improved how the system manages authentication state and shipped in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9, crediting Alfredo Pesoli of Bynario Atlas ^[5][6]. Screen Sharing is the remote desktop tool built into every Mac ^[7], and it listens on port 5900 ^[8]. NCSC-NL says the abuse reports it received involved multiple systems where 5900 was accessible directly from the internet ^[9].

None of this required sophistication. Security firm Calif, which analyzed the flaw alongside two other Screen Sharing bugs Apple patched a month earlier in macOS 26.6, found no memory corruption, no exploitation trickery and no race condition to win, just logic errors that let a couple of correctly ordered packets walk past authentication ^[10]. CVE-2026-65400 sits in the same source code file as those earlier bugs ^[11]. One of them was genuinely pre-authentication, and a researcher using the handle @osxreverser described needing nothing but the target's IP address to exploit it, with no username and no password ^[12]. That researcher also reported finding roughly 40,000 exposed Screen Sharing hosts during an internet scan, nearly half of them in the US, spanning residential connections, university networks and at least a few corporate servers ^[13]. That is on the order of 20,000 exposed hosts in the US alone ^[14].

The detail defenders should carry forward is not the miner. Calif says it built working exploits for both vulnerabilities in about four hours using an AI coding agent ^[15]. A coordinated vendor fix followed by public patch notes now buys days, not weeks, and the cost of turning an advisory into a functioning exploit is approaching the cost of reading it.

Which is why "unpatched" is the wrong status for an exposed host. An update repairs the authentication logic; it does not remove root-level access that was already obtained, and every documented intrusion here ended in root ^[2]. A cryptominer is the cheapest thing an opportunist can do with that access, and SecurityAffairs reads the payload as evidence of opportunistic scanning rather than a targeted campaign, for now ^[16]. The same access would support quieter outcomes, and the reported cases are only the ones that were noticed.

If you cannot update immediately, SecurityAffairs advises turning Screen Sharing off entirely under General, Sharing, until you can ^[17].

Watch whether the payload mix shifts away from mining, which would indicate someone other than commodity scanners has picked up the exploit. Watch the exposed-host count: if the 40,000 figure ^[13] does not fall materially, the residential and university tail will keep this alive for months. And watch that same source code file for a fourth bug.