CVE-2026-65400 let anyone on the network log into a Mac as root with zero credentials. Apple patched it August 6. Attackers were already inside, planting a cryptominer.
Apple's built-in Screen Sharing app has a feature almost nobody uses on purpose and almost nobody remembers is running: a remote-desktop daemon called screensharingd, reachable over the network the moment it's turned on. CVE-2026-65400 let an attacker who could reach that service authenticate as root without a valid password at all — no exploit chain, no social engineering, just the right two packets in the right order. Apple patched it on August 6 in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. Microsoft's threat intelligence team and the Dutch national cyber security center had already caught it being used in the wild — to install a cryptocurrency miner.
How you skip a password with two packets
The bug is a logic error in how screensharingd tracks authentication state. According to technical analysis of the flaw, a length check on an oversized network frame bails out early — and hands back the exact same value the code uses to signal a successful login. Send Screen Sharing one or two packets in the right sequence, and the daemon hands you root without ever checking a password. It's the kind of bug that sounds almost too simple, but 'an oversized frame trips an early-return path that happens to return success' is a familiar shape in authentication code, and it's exactly why security researchers keep fuzzing these services for a living. Apple's advisory describes it more clinically as an 'improved state management' fix, which is Apple-speak for 'the login check could be skipped.'
From bug to cryptominer
Before August 2026
Security researcher Alfredo Pesoli (Bynario) discovers and reports the Screen Sharing authentication bypass.
August 6, 2026
Apple patches CVE-2026-65400 in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9.
Mid-August 2026
Microsoft Defender and NCSC-NL confirm active exploitation against internet-exposed Macs, tracing installs of the XMRig cryptominer.
August 14, 2026
CISA rescores the flaw from 7.1 to 9.8 (Critical) and adds it to the Known Exploited Vulnerabilities catalog.
What attackers actually did with root
Getting root through Screen Sharing was the opening move, not the whole plan. Once inside, attackers transferred a set of scripts and an SSH public key onto the Mac through the same Screen Sharing session, then used that to set up SSH persistence so they didn't need the bug a second time. They cleared histories and logs to cover the entry, modified the built-in Packet Filter firewall — presumably to keep their own access open — and dropped XMRig 6.26.0, a well-known Monero-mining tool, disguised as a hidden binary at .config/sysmond and set to relaunch automatically via a LaunchDaemon. None of that is sophisticated. It's the standard playbook for turning a compromised machine into free compute the moment root shows up for free. The Hacker News' full writeup has the complete persistence chain.
Attackers used the stolen root access to quietly install XMRig, a Monero-mining tool, rather than steal data. · Unsplash
Are you exposed?
Verdict
Who needs to act now
Anyone running Screen Sharing on a Mac reachable from an untrusted network — a home Mac with port forwarding, a Mac mini used as a remote-access server, or any machine on a network segment attackers can already reach. If Screen Sharing is off, or only reachable over a VPN you trust, your exposure window is much smaller, but you should still update.
Best for: Mac admins, remote-access users, anyone running Macs as always-on servers
This is a smaller-scale echo of the pattern this desk keeps tracking in enterprise gear: an authentication check with a logic hole, exploited quietly for real money before the vendor's CVSS score even reflected the danger. It's the same shape as the unauthenticated management-console bugs in N-able's N-central and Citrix's NetScaler, and a reminder that state-linked crews aren't the only ones hunting these — the fake job offers Lazarus used against Windows users prove nation-states want access too, just for different ends.
Do I need Screen Sharing turned on for this to affect me?
Yes. If Screen Sharing is off in System Settings, screensharingd isn't listening and this specific bug isn't reachable.
Does updating macOS remove the XMRig miner if I was already infected?
No — the patch closes the entry point, but it won't undo a prior compromise. If you suspect you were hit, check for unfamiliar LaunchDaemons, an SSH key you didn't add, and a hidden .config/sysmond process.
Is this the same bug as any recent iPhone vulnerability?
No, this is specific to the macOS Screen Sharing daemon (screensharingd) and doesn't affect iOS.
How do I know if my Mac is patched?
Check About This Mac for Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9 or later. Anything before that, on the affected branches, is still vulnerable.
Screen Sharing is one of those macOS features most people turned on once, years ago, for a single remote-help session, and never thought about again. This is exactly why it's dangerous — it's still listening. Update to the patched build, and while you're in System Settings, actually check whether Screen Sharing needs to be on at all. For most people, the honest answer is no.
