Security 1 publisher3 min readPublished Aug 16, 2026, 5:16 PM PDT

Pre-auth flaw in macOS Screen Sharing turns any exposed Mac into an arbitrary file read

Huntress says a public proof of concept needs only an IP address to pull any file off unpatched Macs, driving a helper process that carries Full Disk Access.

The Watch · Security desk

Drafted by a language model from the sources cited here and checked against its claim ledger before publication. How we use AI Send a correction

What happened

Huntress published a write-up titled "From Screen Share to Root Access: Breaking Down CVE-2026-43760 and CVE-2026-65400 on macOS", covering two macOS Screen Sharing vulnerabilities.
Apple's security releases announced in the last week of July were followed by a flurry of activity, public disclosures of newly patched bugs and commentary on the scale of the CVEs listed, including references to bugs in the Screen Sharing server; a week later Apple released a patch to comprehensively squash a bug of significant consequence.
Screen Sharing on macOS uses the RFB (Remote Framebuffer) protocol, the primary protocol supporting VNC and its derivatives.
Screen Sharing allows two distinct authentication paths: native Apple authentication, a username and password associated with a user account on the system, and legacy VNC authentication, a single password not associated with any specific macOS user that allows interaction with the currently logged-in user.
The Screen Sharing system daemon is supported by two privileged user helpers that handle file operations, SSFileCopySender and SSFileCopyReceiver; under native Apple username:password authentication they are tied to execution in the user's context, but under legacy VNC they operate with root privileges.

Compiled by The WatchSomething wrong?How this is made

Why it matters

Huntress has published a breakdown of two macOS Screen Sharing vulnerabilities, CVE-2026-43760 and CVE-2026-65400, and the second is the one that changes your week: a public proof of concept that needs nothing but the IP address of an exposed Mac to read any file on it ^[1]^[9]. Apple's security releases in the last week of July were followed by a run of disclosures and commentary about Screen Sharing bugs, and Apple then shipped a further patch that Huntress describes as comprehensively squashing a bug of significant consequence ^[2].

The architecture explains the blast radius. Screen Sharing speaks RFB, the protocol behind VNC and its derivatives ^[3], and supports two authentication paths: native Apple auth against a real macOS account, and legacy VNC, a single password bound to no user that drives whatever session is currently logged in ^[4]. Two privileged helpers, SSFileCopySender and SSFileCopyReceiver, handle the file operations. Under native auth they run in the user's context. Under legacy VNC they run as root ^[5].

On July 29, bynar.io detailed CVE-2026-43760, a confused-context condition that required an authenticated session and let any legacy-VNC user read and create arbitrary filesystem artifacts as root ^[6]. Bad, but with a precondition an operator can reason about: someone had to hold the VNC password.

CVE-2026-65400 removes the precondition. According to Huntress, Apple's service fixes appear to have partially closed a pre-authentication bug in screensharingd, intentionally or otherwise ^[7], and Pedro Vilaca (fG!) then published a post confirming the patch, along with an obfuscated proof-of-concept binary ^[8]. Against hosts at or below macOS 26.5.2, 15.7.7, or 14.8.7, which covers three supported release trains ^[15], the PoC discloses any filesystem artifact to anyone holding the address ^[9]. It works because it drives SSFileCopySender, which inherits the private Apple-signed entitlement kTCCServiceSystemPolicyAllFiles: Full Disk Access, TCC bypassed entirely ^[10]. Huntress reports the PoC succeeded against a service with legacy VNC authentication disabled and no local Apple user accounts enabled for access ^[11], which retires the two configuration mitigations most teams would reach for first. Huntress attributes the failure to errors in the daemon's implementation of Secure Remote Password, including its frame-length validator ^[12].

The inventory problem is larger than the patching problem. Apple describes Screen Sharing as a service that lets users of other computers "on your network" connect to view and control your Mac ^[14], and with the growth of hosted bare-metal Apple hardware, including on-demand Mac minis, SSH and Screen Sharing are commonly enabled by default on newly provisioned service ^[13]. Those machines are not on your network. They have routable addresses, and they were frequently stood up by a developer with a credit card rather than through a build process that would have turned the service off.

Watch for whether the obfuscated proof of concept is reverse-engineered into something reusable, since disclosure of arbitrary files as root includes credentials and keys that make the file-write primitive in CVE-2026-43760 largely academic ^[6]^[9]^[10]. Watch, too, for further findings in the same daemon: Huntress frames the SRP problem as errors in the implementation rather than a single logic slip ^[12].

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[11]
The proof of concept, tracked as CVE-2026-65400, successfully exploited a Screen Sharing service with both legacy VNC authentication disabled and no local Apple user accounts enabled for access.
ReportedSupportedSource: Huntress2 sources— create a free account to open them View cited source
[1]
Huntress published a write-up titled "From Screen Share to Root Access: Breaking Down CVE-2026-43760 and CVE-2026-65400 on macOS", covering two macOS Screen Sharing vulnerabilities.
ReportedSupportedSource: HuntressView cited source
[2]
Apple's security releases announced in the last week of July were followed by a flurry of activity, public disclosures of newly patched bugs and commentary on the scale of the CVEs listed, including references to bugs in the Screen Sharing server; a week later Apple released a patch to comprehensively squash a bug of significant consequence.
ReportedSupportedSource: HuntressView cited source
[3]
Screen Sharing on macOS uses the RFB (Remote Framebuffer) protocol, the primary protocol supporting VNC and its derivatives.
ReportedSupportedView cited source
[4]
Screen Sharing allows two distinct authentication paths: native Apple authentication, a username and password associated with a user account on the system, and legacy VNC authentication, a single password not associated with any specific macOS user that allows interaction with the currently logged-in user.
ReportedSupportedView cited source
[5]
The Screen Sharing system daemon is supported by two privileged user helpers that handle file operations, SSFileCopySender and SSFileCopyReceiver; under native Apple username:password authentication they are tied to execution in the user's context, but under legacy VNC they operate with root privileges.
ReportedSupportedView cited source
[6]
On July 29, bynar.io disclosed research on CVE-2026-43760, which exploited a confused-context condition and relied on an authenticated session; it allowed any user authenticated via the legacy VNC method to read and create any filesystem artifact as root.
ReportedSupportedSource: bynar.io research, as described by HuntressView cited source
[8]
Following Apple's July security release and the bynar.io research, Pedro Vilaca (aka fG!) published a blog post confirming that a pre-authentication bug in the daemon's authentication mechanism had been patched by Apple, accompanied by an obfuscated proof-of-concept binary.
ReportedSupportedSource: Huntress, citing Pedro VilacaView cited source
[9]
The proof of concept enabled anyone with the IP address of a Screen Sharing-enabled macOS host running macOS 26.5.2 or earlier, macOS 15.7.7 or earlier, or macOS 14.8.7 or earlier to exploit the bug and disclose any filesystem artifact.
ReportedSupportedSource: HuntressView cited source
[10]
The proof of concept used the file operations supported by the SSFileCopySender helper process, which carries the private Apple-signed entitlement kTCCServiceSystemPolicyAllFiles, granting Full Disk Access and bypassing TCC protections entirely.
ReportedSupportedView cited source
[12]
Screen Sharing uses Secure Remote Password (SRP) for its native Apple authentication path, and the screensharingd system daemon appears to have errors in its SRP implementation, including its frame-length validator.
ReportedSupportedSource: HuntressView cited source
[14]
Apple describes Screen Sharing on macOS as a service that "allows users of other computers on your network to remotely connect to your Mac to view your desktop and control your Mac."
ReportedSupportedView cited source
[15]
The version ceilings named in the proof-of-concept description span three separate macOS release trains: 26.x, 15.x and 14.x.
DerivedSupported1 source— create a free account to open them
[7]
While addressing service vulnerabilities, Apple, intentionally or otherwise, appears to have partially fixed a pre-authentication vulnerability in screensharingd.
ReportedInsufficientSource: Huntress2 sources— create a free account to open them View cited source
[13]
With the uptick in hosted bare-metal Apple devices, such as the Mac mini available for on-demand workloads, SSH and Screen Sharing are commonly enabled by default on any newly provisioned service.
ReportedInsufficient2 sources— create a free account to open them View cited source

Sources

Publishers whose own reporting we read for this story.

huntress.com
1 article · August 16, 2026
From Screen Share to Root Access: Breaking Down CVE-2026-43760 and CVE-2026-65400 on macOS | Huntress

Ask Clarity

Have a question this piece left open? The answer comes from its reporting and claim ledger — nothing else.

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

Builder

For builders the value is in the mechanism: Screen Sharing rides RFB, offers two authentication paths, and delegates file operations to SSFileCopySender and SSFileCopyReceiver whose privilege context depends on which path was used. The reported defect sits in screensharingd's Secure Remote Password implementation, where a frame-length validator returns a stale success and the session is treated as authenticated while continuing in cleartext. The lesson generalises: authentication state that can be inherited from a validator's return value, plus a helper process holding a private Full Disk Access entitlement, converts a protocol parsing bug into arbitrary root-level file access. Only one publisher documents this, and the code-level detail beyond the entitlement dump is limited.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence68: 0100
Detailed single-vendor technical account
The account is specific and partly verifiable in kind: a codesign entitlement dump for SSFileCopySender, a named SRP frame-length validator defect, explicit affected version ceilings, two CVE identifiers, and a hands-on verification that the cron-based RCE chain fails under TCC. What is absent from the cluster is any Apple advisory, patch identifier, or independent publisher reproducing the findings, and the key assessment that Apple only partially fixed the pre-auth bug is hedged with 'appears to'.
Adoption42: 0100
Public exploit and patch exist; exposure unmeasured
Real-world uptake signals are present on the research and vendor side: a July 29 third-party disclosure, a public proof-of-concept binary, an Apple patch, and a follow-on PoC that Huntress tested. What is missing is the demand-side measurement that would raise this: no count of internet-exposed Screen Sharing hosts, no hosted-provider defaults evidenced by name, no patch-uptake data, and no in-the-wild exploitation telemetry.
Hype gap+12: −100 understated0 aligned+100 overstated
Slightly overstated at the headline
The core arbitrary-file-read claim is well matched to the technical detail supplied, and the article volunteers its own limits: the cron-based RCE path failed against TCC and reportedly needs SIP disabled. The overstatement is at the framing level - 'any exposed Mac' elides that a patch already exists and that the version ceilings bound the affected population, while the unquantified assertion about hosted bare-metal defaults enlarges the perceived blast radius without data.
Incentives62: 0100
Security vendor research with visibility upside
The sole source is a commercial endpoint security vendor publishing threat research under its own brand, an established channel for demonstrating macOS expertise and generating inbound attention; the piece also amplifies named independent researchers whose reputational incentive runs the same direction. Offsetting this, the write-up sells no product in the supplied text, names no detection SKU, and actively debunks part of a third party's exploit chain, which is not the behaviour of pure promotion.
Confidence55: 0100
Moderate: plausible and specific, but uncorroborated
Confidence is limited chiefly by cluster structure rather than plausibility: one publisher, no Apple advisory, no independent write-up in evidence, and the patch-completeness assessment explicitly hedged. The specificity of the mechanism, version ceilings, entitlement evidence, and self-reported negative result raise it above a bare single-source rumour.

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

macOS Security Follow
Remote Access Service ExposureFollow
Vulnerability Disclosure Follow
TCC and Privilege BypassFollow
Authentication Protocol Implementation FlawsFollow

Entities

Huntress Follow
Apple Follow
macOS Screen SharingFollow
screensharingdFollow
SSFileCopySenderFollow
SSFileCopyReceiverFollow
CVE-2026-43760Follow
CVE-2026-65400 Follow
Pedro VilaçaFollow
bynar.ioFollow
bl4styFollow
RFB (Remote Framebuffer) protocolFollow
Secure Remote Password (SRP)Follow
Transparency, Consent and Control (TCC)Follow
System Integrity Protection (SIP)Follow

Pre-auth flaw in macOS Screen Sharing turns any exposed Mac into an arbitrary file read

What happened

Why it matters

Claim ledger

Sources

Topics and entities

Topics

Entities

Claim ledger

Topics and entities

Topics

Entities

Perspective Coverage

Builder

Operator

Investor

Reality

Sources

What happened

Why it matters

Claim ledger

Sources

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Related stories

Claim ledger

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Perspective Coverage

Builder

Operator

Investor

Reality

Sources

Related stories