Apple macOS Screen Sharing Flaw Exploited on Internet-Exposed Macs to Install Monero Miner
Summary: The Netherlands National Cyber Security Centre reported active abuse of CVE-2026-65400, a critical authentication flaw (CVSS 9.8) in macOS Screen Sharing that lets an attacker already on the network authenticate without valid credentials, on systems where port 5900 was reachable from the internet. Microsoft said on August 18, 2026 that it observed exploitation on a limited number of macOS devices, with attackers gaining root sign-in through Screen Sharing, transferring scripts and an SSH public key, establishing SSH persistence, clearing logs, modifying Packet Filter settings, and deploying the XMRig 6.26.0 Monero miner disguised as com[.]apple[.]airportd.
Why it matters: Apple patched this in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9, and any Mac with Screen Sharing exposed on TCP/5900 that has not taken those updates is a candidate for a root-level compromise that survives reboots through a LaunchDaemon. A separate pre-authentication flaw in the same source file, which researcher @osxreverser said they withheld from Apple, was fixed in macOS 26.6, and an AI security company reported building working exploits for both in four hours.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2026-43760CVE-2026-65400
- Related
- CVE-2026-65400: Apple macOS Improper Authentication Vulnerability Known Exploited Vulnerabilities · Aug 18, 2026