Reported by 3 outlets

Timeline

1. original reporting

   Hackers exploit macOS Screen Sharing flaw to deploy Monero miner

   bleepingcomputer.com · 60d ago · August 14th, 2026

   The Netherlands’ National Cyber Security Centre (NCSC) is warning that hackers are actively exploiting a macOS authentication bypass vulnerability after public exploit code emerged. The security issue lies in macOS Screen Sharing, a built-in remote desktop feature that allows remote desktop control over a network, using the VNC protocol over TCP port 5900. Apple fixed CVE-2026-65400 on August 6 in macOS Tahoe 26.6.1 and earlier releases. The flaw allows network-based attackers to gain access without valid credentials. An attacker could use this access to open applications remotely, access files, change security settings, and perform various other actions. In an update to the initial advisory, the Dutch agency said it received a report indicating that the vulnerability is being exploited in the wild in attacks where port 5900 is exposed to the internet. According to the NCSC, the attacker obtained root access to the system and deployed a Monero cryptocurrency miner. “The NCSC has received a notification indicating that active abuse of this vulnerability has been observed on multiple systems on which port 5900 was accessible from the Internet,” reads the Dutch agency's update . “In all these cases, root had been accessed on the affected system, and a Monero crypto miner had been placed.” macOS users are recommended to upgrade their system to one of the following releases, which address CVE-2026-65400: macOS Tahoe 26.6.1 macOS Sequoia 15.7.9 macOS Sonoma 14.8.9 These releases im

2. mentioned by securityweek.com

   Recent macOS Screen Sharing Vulnerability Exploited in Attacks

   securityweek.com · 57d ago · August 17th, 2026

3. update from malware.news

   your Mac: Screen Sharing vulnerability exploited in the wild

   malware.news · 57d ago · August 17th, 2026

   macOS’s built-in Screen Sharing service is a remote-control feature commonly associated with port 5900. Successful exploitation can allow a remote attacker on a reachable network to authenticate to the service without legitimate credentials. Apple said the bug was fixed through “improved state management,” which suggests an authentication-flow or session-state validation failure rather than a cryptographic break. Practical exposure requires Screen Sharing to be enabled, so the highest-risk systems are those where port 5900 is internet-accessible, typically through a router port-forward, public IP assignment, or hosting-provider setup. Hosts reachable only from an internal network are still potentially expo