Vulnerability
CVE identifying a macOS Screen Sharing flaw that lets attackers bypass authentication and gain unauthenticated network access via port 5900.
Apple's emergency macOS update on August 6 fixed a Screen Sharing flaw that calif.io turned into a working exploit about four hours later. The flaw let anyone on the network sign in without a password, and the service answering those connections runs as root.
Reality
Dutch officials report root access and Monero miners on Macs with port 5900 open to the internet. Sonoma, Sequoia and Tahoe all need the update Apple shipped as an important security fix.
Perspective Coverage
5 publishersReality
The Dutch NCSC says CVE-2026-65400 was abused within two weeks of Apple's fix, with root access and Monero miners in every reported case. Patching closes the door; it does not evict anyone.
Perspective Coverage
6 publishersReality
Apple's September 14 releases close 273 unique vulnerabilities across ten advisories, with no exploitation reported. Fleet managers have to pick which lane to patch on, and the 26.7 build leaves out about 56 of the fixes that ship in iOS 27.
Reality
CVE-2026-65400 let an attacker on the network authenticate to Screen Sharing without valid credentials. Apple's note names macOS Tahoe only, so treat wider backport claims as unconfirmed.
Reality
Huntress says a public proof of concept needs only an IP address to pull any file off unpatched Macs, driving a helper process that carries Full Disk Access.
Reality
An authentication state flaw lets anyone who reaches TCP/5900 skip credentials entirely. Multiple cases reported to NCSC-NL ended in root and a Monero miner.
Reality