Critical macOS Screen Sharing Pre-Auth RCE Exploited

A critical authentication logic flaw in the macOS Screen Sharing component (CVE-2026-65400) is under active exploitation. The vulnerability allows remote attackers to bypass authentication and gain full control over affected systems without valid credentials. The Netherlands NCSC has confirmed that internet-exposed Macs with port 5900 open are being targeted to gain root access and install Monero cryptocurrency miners. Apple released emergency updates on August 6, 2026, to address this issue after a series of related flaws were identified in July.

The technical root cause involves a state-machine desynchronization in the screensharingd daemon. While related flaws required a legacy VNC password (CVE-2026-43760), CVE-2026-65400 is a true pre-authentication bypass that only requires knowledge of a valid account name. The impact is severe as the Screen Sharing service's file-copy helpers (SSFileCopySender and SSFileCopyReceiver) retain root authority, allowing attackers to read protected files or create malicious root-owned system policies (e.g., sudoers includes) to achieve persistent remote command execution.

This threat is of highest priority for organizations with macOS fleets. Organizations must patch immediately and audit for internet-exposed remote administration services. The exploitation confirms that AI-driven vulnerability discovery is rapidly collapsing the gap between patch release and weaponization, with researchers demonstrating working exploits within four hours of the patch release.