If you manage Macs in your organisation, this is not a drill. A critical macOS security vulnerability is actively being exploited in the wild, and the attack surface is broader — and more dangerous — than many IT teams may realise. With public proof-of-concept exploit code now circulating, the window for safe remediation is closing fast. Here's everything you need to know and, more importantly, everything you need to do right now.
The Vulnerability: CVE-2026-65400 Explained
Apple has issued emergency macOS updates for a critical Screen Sharing vulnerability, CVE-2026-65400, that can enable unauthenticated attackers to execute code remotely and access files with root-level privileges.
Let that sink in — no password, no credentials, no foothold required.
CVE-2026-65400, the more serious of two recent Screen Sharing flaws, exploits a bug in the Screen Sharing service's implementation of Secure Remote Password (SRP), which ultimately allows pre-authenticated remote code execution on all supported macOS versions.
In plain language, that means an attacker on the same network — or, in some configurations, the open internet — can silently take over a Mac without ever needing to log in.
The vulnerability stems from a bug in the macOS screen sharing capability, which allows a remote party to view the screen and control the keyboard and mouse while a machine is turned on. A flaw in the "state management," which keeps track of preceding events, user interactions, variables, and other system states, is the underlying cause.
Even more alarming:
CVE-2026-65400 removes that prerequisite entirely — a remote attacker needs neither a valid macOS account nor the legacy VNC password to succeed.
Standard hardening measures simply won't protect you here.
How Bad Is the Active Exploitation?
The Netherlands National Cyber Security Centrum warned that "active abuse of this vulnerability has been observed on multiple systems on which port 5900 was accessible from the Internet." In all confirmed cases, root access had been gained on the affected system and a Monero crypto miner had been installed.
Details of CVE-2026-65400 became public at last week's Black Hat security conference
, and
public proof-of-concept research has demonstrated arbitrary file reads and writes, with follow-on work identifying paths to remote code execution, including persistence mechanisms such as LaunchDaemons or shell startup-file modifications.
This is not a theoretical threat. Real attackers are exploiting real machines right now — and the crypto miner deployments observed are almost certainly not the worst use case threat actors have in mind.
Why This Flaw Is So Dangerous for Enterprises
This vulnerability is particularly troubling for enterprise environments for several reasons.
It bypasses conventional hardening.
If you cannot patch immediately, disabling Screen Sharing is the only meaningful mitigation. As this is a pre-auth bug, the usual hardening does not help: removing allowed user accounts, disabling legacy VNC password authentication, or rotating the VNC password have no effect.
It affects every supported macOS version.
The issue is tracked as CVE-2026-65400 and affects multiple versions of macOS. Apple has released macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9, all addressing the same vulnerability.
It came fast on the heels of another Screen Sharing flaw.
CVE-2026-65400 follows closely on the heels of CVE-2026-43760, a separate Screen Sharing bug disclosed in late July. Although both involve Apple's Remote Framebuffer/VNC implementation, their attack requirements differ sharply.
Two critical bugs in the same component within weeks is not a coincidence — it signals sustained attacker interest in this attack surface.
The endpoint exposure is enormous.
73% of Mac devices contain at least one vulnerable app, according to Jamf's Security 360: 2026 Annual Trends Report
— and that's under normal circumstances. When a zero-day is actively circulating, unpatched fleets become a liability overnight.
The Broader macOS Threat Landscape in 2026
This vulnerability doesn't exist in isolation.
In 2026, there have already been 474 vulnerabilities in Apple macOS with an average score of 6.9 out of ten.
Apple's 2026 security cycle has been dominated by a steady stream of updates across iOS, iPadOS, macOS, watchOS, tvOS, visionOS, and Safari.
On March 5, 2026, CISA added three security flaws affecting macOS, iOS, iPadOS, and other Apple products to its Known Exploited Vulnerabilities (KEV) catalog.
The severe risk of arbitrary code execution and kernel-level system access demands immediate remediation.
Perhaps most striking is what's driving Apple's accelerated patch cadence.
Apple told Reuters that the move is a direct response to new threats enabled by increasingly powerful AI models — the company needed to reduce the time between when updates were first made public and when they were put into customers' hands.
AI is making exploit development faster, which means your patch window is shrinking. Speed now matters more than ever.
Practical Tips: What IT Teams Must Do Immediately
This is not a situation for scheduled maintenance windows. Here's your action checklist — prioritised for maximum impact:
1. Patch everything now.
Update to macOS 26.6.1, 15.7.9, or 14.8.9 (released August 6, 2026). These are the only builds that fully address the pre-authentication bug and close CVE-2026-65400.
Use your MDM platform to push this update immediately across your entire managed fleet.
2. If you can't patch immediately, disable Screen Sharing.
If immediate patching is impossible, disabling Screen Sharing removes the vulnerable remote service from exposure.
This is your interim control — deploy it now and patch as fast as possible.
3. Audit which devices have Screen Sharing enabled.
Don't assume it's only a handful of machines. Screen Sharing can be inadvertently enabled during onboarding or remote support sessions.
Monitoring the patch status of all devices is crucial to ensure compliance and security. MDM tools allow IT administrators to track patching progress in real time, identifying which devices have successfully updated and which may have encountered issues. Continuous monitoring also helps identify any devices that have missed critical updates or remain out of compliance.
4. Block port 5900 at the network perimeter.
The flaw is especially dangerous on systems where Screen Sharing is exposed to the public internet.
Ensure firewall rules block inbound connections on TCP port 5900 from untrusted networks. This won't fix the bug, but it significantly reduces your external attack surface while patching is underway.
5. Implement phased but rapid patch rollouts.
Your IT and security team devices should receive updates first, followed by pilot groups across different departments and geographic regions. This phased approach catches issues early when they affect dozens of devices rather than thousands.
6. Monitor for indicators of compromise.
If a threat actor attempts to guess a valid account, the Screen Sharing events will include the attribute session_username: null, providing further opportunities for noisy enumeration.
Review your endpoint logs and SIEM alerts for anomalous Screen Sharing activity.
7. Communicate with your users.
End-user education is essential for smooth patch management. Ensure that employees understand the importance of timely updates and how delaying them can impact security and performance.
A brief, clear communication can prevent users from dismissing or deferring prompts at the worst possible moment.
Don't Treat This as Business as Usual
Even if you don't use Screen Sharing, it may be a good idea to install the update sooner rather than later, given that Apple deemed the vulnerability serious enough to patch across three versions of macOS without prior beta testing or waiting for its next major round of OS updates.
An out-of-cycle emergency patch is Apple's clearest possible signal that this is serious.
The message for security teams is simple: apply Apple's updates without delay, verify coverage across all managed devices, and document the process for future audit purposes.
The days of treating macOS as an inherently "safer" platform are firmly behind us.
Last year, Apple patched nine zero-day vulnerabilities that were exploited in the wild
— and 2026 is on track to be even more demanding.
Take Action Today — Your Fleet Can't Wait
The exploit is public. Attacks are confirmed. The patch is available. There is no justification for delay.
If your organisation doesn't yet have an automated macOS patch management workflow or a robust MDM solution capable of enforcing emergency updates at scale, this incident should be the catalyst that changes that. Audit your Screen Sharing exposure right now, deploy macOS Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9 across every managed device today, and review your firewall rules before close of business. Then use this moment to build the processes — automated patching, continuous compliance monitoring, and rapid incident response playbooks — that will protect your organisation when the next critical vulnerability arrives. Because based on 2026's trajectory, it won't be long.
