Legacy VNC RFB security-type 2 authentication negotiation on macOS Screen Sharing from external source

Duo Tech@duotech

•updated Aug 17, 2026•1•0•26

Detects legacy RFB security-type 2 (VNC password) authentication negotiation against macOS Screen Sharing from external sources, indicating legacy-VNC administration or abuse of the CVE-2026-43760 legacy-auth path that retains root file-copy authority.