CVE-2026-65400

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-65400 9.8

Apple · macOS · Added 2026-08-18 · Published 2026-08-06

3-Day Required KEV Automatable Active Exploitation

Details

VulnerabilityApple macOS Improper Authentication Vulnerability

VendorApple

ProductmacOS

Date added2026-08-18

Due date2026-08-21

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-287

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.

NVD: An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-08-18 17:53 UTC

Wall time0.5s

Searches1

Component defaultno

Sources https://support.apple.com/en-us/148170
https://nvd.nist.gov/vuln/detail/CVE-2026-65400
https://www.macminivault.com/security-advisory-critical-macos-screen-sharing-vulnerability-cve-2026-65400/
https://www.huntress.com/blog/macos-screen-sharing-rce-patched
https://thehackernews.com/2026/08/apple-macos-screen-sharing-flaw.html
https://www.securityweek.com/recent-macos-screen-sharing-vulnerability-exploited-in-attacks/

QC notes

info precondition_contradiction: Preconditions don't mention deployment applicability (component/product version)

Hunting hypothesis agent

Hunt for VNC protocol handshake anomalies on TCP port 5900 where the SRP authentication state transitions are manipulated to bypass credential validation.

Research details

ComponentScreen Sharing service (VNC/SRP authentication handler on TCP port 5900)

PreconditionsNetwork access to TCP port 5900 on a macOS host with Screen Sharing enabled; Screen Sharing must be explicitly turned on in System Settings > General > Sharing; the service uses SRP (Secure Remote Password) for authentication, which is bypassed via the state management flaw. agent

DeliveryNetwork (Screen Sharing / VNC protocol)

Public PoCno

Advisoryhttps://support.apple.com/en-us/148170

Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS >= 9.0) | Pre-authentication bypass via SRP state management flaw | Actively exploited in the wild to install Monero miners on internet-exposed Macs

SummaryApple macOS Screen Sharing authentication bypass allowing unauthenticated network access to the VNC-based screen sharing service. CVSS 9.8; patched August 6 2026 in macOS Sequoia 15.7.9, Sonoma 14.8.9, Tahoe 26.6.1. Actively exploited.

Tia coverage

First reported2026-08-07

First exploit report2026-08-14

Exploit report → KEV4 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

apple-security-advisory-av26-823 apple-ships-emergency-macos-patches-for-pre-auth-screen-sharing hackers-exploit-macos-screen-sharing-flaw-to-deploy-monero-miner microsoft-and-apple-ship-fresh-updates-three-cvss-10-0-four-9-9 no-country-for-old-passwords

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.