macOS Screen Sharing root file-copy to sensitive paths without valid prior auth (CVE-2026-65400)

Duo Tech@duotech

•updated Aug 17, 2026•22•0•48

Detects SSFileCopySender/SSFileCopyReceiver helpers running as uid=0 reading or writing sensitive system paths during Screen Sharing sessions using legacy VNC auth or lacking a preceding valid local logon — abuse of the root file-copy primitive underlying CVE-2026-65400.