Root Screen Sharing Session Without Preceding Successful Authentication

Duo Tech@duotech

•updated Aug 17, 2026•2•0•10

Detects a root-privileged Screen Sharing session with no successful authentication event in the preceding window, indicating exploitation of the screensharingd pre-auth bypass (CVE-2026-65400); excludes known ARD/MDM admin workflows.