Critical macOS Screen Sharing Authentication Bypass Exploited

A critical vulnerability in the macOS Screen Sharing service, identified as CVE-2026-65400, is being actively exploited in the wild. The flaw stems from an erroneous frame-length validation in the Secure Remote Password (SRP) implementation within the screensharingd daemon, allowing network-based attackers to bypass authentication entirely without valid credentials. The Netherlands' National Cyber Security Centre (NCSC) has confirmed that attackers are targeting systems with port 5900 exposed to the internet to gain root-level access and deploy Monero cryptocurrency miners.

Technical analysis reveals that the exploitation results in a cleartext session lacking cryptographic protection, where the attacker inherits the Full Disk Access entitlements of the SSFileCopySender helper process. This bypasses Transparency, Consent, and Control (TCC) protections, enabling arbitrary file read/write operations and remote code execution through LaunchDaemons or shell startup modifications. The vulnerability is particularly dangerous for hosted Mac environments where remote management services are often enabled by default.

Immediate patching is required as traditional hardening measures, such as rotating VNC passwords or removing allowed users, do not mitigate this pre-authentication flaw. Organizations unable to patch immediately should disable Screen Sharing and restrict access at the network boundary.