If your organization uses Apple Mac computers, a newly disclosed vulnerability demands your immediate attention. CVE-2026-65400 is a critical authentication flaw in macOS Screen Sharing that allows attackers to gain unauthorized remote access without valid credentials. This vulnerability has moved beyond theoretical risk—threat actors are actively exploiting it in the wild to deploy cryptocurrency miners and establish persistent access to corporate systems. This post explains what this means for your business operations, how to determine if you are affected, and the concrete steps you should take to protect your organization.
Apple disclosed CVE-2026-65400 on August 6, 2026, releasing emergency patches across three macOS branches. The vulnerability was reported by security researcher Alfredo Pesoli via Bynario Atlas. It carries a CVSS 3.1 base score of 9.8, classified as Critical severity. The flaw is an improper authentication vulnerability—specifically, an authentication bypass in the Screen Sharing daemon that lets network-based attackers authenticate without valid credentials. On August 18, 2026, CISA added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. Federal Civilian Executive Branch agencies were required to patch by August 21, 2026.
This vulnerability poses severe risks to your organization's security posture and operational continuity. An attacker who exploits this flaw gains unauthorized remote access to affected Mac systems—potentially with root-level privileges. From a business perspective, this translates into four critical risk areas.
First, your operations face direct disruption. Attackers have already used this vulnerability to deploy Monero cryptocurrency miners, consuming system resources and degrading performance across your fleet. Second, your data is at risk. Unauthorized remote access means attackers can exfiltrate sensitive business information, customer records, or intellectual property without detection.
Third, your reputation is on the line. A breach stemming from an unpatched, known vulnerability signals negligence to customers, partners, and regulators. Fourth, compliance obligations may be triggered. CISA's KEV designation means this vulnerability carries regulatory weight—particularly for organizations serving federal agencies or operating in regulated sectors. Failure to patch within mandated timelines could expose your organization to enforcement actions or contractual penalties.
Regional Financial Institution: A mid-sized credit union with 200 Mac endpoints failed to patch within the CISA deadline. Attackers exploited CVE-2026-65400 to access internal systems, exfiltrating customer account data. The breach triggered a regulatory investigation and required costly customer notification and credit monitoring services.
Healthcare Provider Network: A multi-clinic medical practice running macOS on administrative workstations delayed patching due to concerns about workflow disruption. Exploitation led to ransomware deployment across the network, forcing clinic closures for three days and resulting in rescheduled patient appointments and lost revenue.
Technology Consulting Firm: A 50-person software consultancy with a bring-your-own-device policy had employees using unpatched MacBooks. Attackers gained access through Screen Sharing, installed persistence mechanisms, and used the firm's infrastructure to launch attacks against client environments—jeopardizing client relationships and triggering liability reviews.
Retail Chain Headquarters: A regional retailer with macOS-based point-of-sale management systems experienced exploitation that led to cryptocurrency mining across hundreds of devices. The resulting performance degradation caused transaction processing delays during peak shopping hours, directly impacting sales and customer satisfaction.
You are affected if any of the following apply to your organization:
Do not wait for an incident to validate your exposure. Contact IntegSec today to schedule a penetration test focused on macOS security and endpoint hardening. Our team will identify unpatched systems, test your detection capabilities, and provide actionable recommendations to reduce your cybersecurity risk. Visit https://integsec.com to engage our experts and protect your organization from threats like CVE-2026-65400.
CVE-2026-65400 is an improper authentication vulnerability (CWE-287) in the macOS Screen Sharing daemon, screensharingd. The root cause is insufficient session-state management in the Secure Remote Password (SRP) authentication protocol, allowing a network-based attacker to bypass pre-authentication checks and establish a Screen Sharing session without valid credentials. The attack vector is network-based (AV:N), requires no privileges (PR:N), needs no user interaction (UI:N), and has low attack complexity (AC:L). Successful exploitation grants root-level remote code execution. The CVSS 3.1 vector string is AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H, yielding a base score of 9.8. The vulnerability is tracked in the NVD under CVE-2026-65400.
Version Enumeration Commands:
sw_vers -productVersion and compare against patched versions (14.8.9, 15.7.9, 26.6.1).launchctl list | grep screensharing or systemsetup -getremotelogin. Scanner Signatures:
Log Indicators:
/var/log/system.log for unexpected screensharingd authentication events.log show --predicate 'process == "screensharingd"'.xBehavioral Anomalies:
Network Exploitation Indicators:
1. Immediate (0–24h):
sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -deactivate -stop.2. Short-term (1–7d):
screensharingd authentication anomalies.x3. Long-term (ongoing):
Interim Mitigations (if patching is not immediately feasible):
kickstart command above.