macOS Screen Sharing Vulnerability Exploited, Hacker Gains Root Access and Deploys XMR Mining Malware

BlockBeats News, August 17th, According to the Dutch National Cyber Security Centre (NCSC-NL), attackers are exploiting a critical authentication bypass vulnerability CVE-2026-65400 in the macOS Screen Sharing feature to target Mac devices exposed on the internet. This vulnerability has a CVSS score of 9.8, allowing attackers to bypass authentication without valid credentials and gain root privileges on the system.

NCSC-NL stated that they have received multiple reports of active exploitation, with the affected devices' 5900 ports directly accessible from the internet. In the confirmed cases so far, attackers have successfully obtained root privileges and deployed a Monero (XMR) mining program on the compromised Mac devices.

Apple has recently patched this vulnerability through macOS versions Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. Security Affairs reminds users who have Screen Sharing enabled and have not yet updated their systems to do so promptly. If updating immediately is not possible, users should disable the Screen Sharing feature to prevent exposing the 5900 port to the internet.