Critical macOS Screen Sharing flaw reported under active exploitation

The Netherlands National Cyber Security Centre has reported active abuse of CVE-2026-65400, a critical macOS Screen Sharing authentication flaw, on multiple systems with internet-accessible port 5900. The agency said attackers gained root access and installed Monero miners in the reported cases. Apple addressed the issue in emergency updates for macOS Tahoe 26.6.1, Sequoia 15.7.9 and Sonoma 14.8.9. The flaw affects Screen Sharing and could let an attacker already on a network authenticate to the built-in remote-desktop service without valid credentials. Apple said its fix improves state management to enforce credential validation.