macOS Screen Sharing CVE-2026-65400 is being exploited to mine Monero on your Mac
On August 12, 2026, the Dutch National Cyber Security Centre (NCSC) warned that attackers are actively scanning for Macs with port 5900 exposed to the internet and using CVE-2026-65400 to gain root access without a password. In every confirmed case, the attackers planted a Monero cryptocurrency miner. The patch has been available since August 6. If you run macOS Screen Sharing and have not updated, this is an active exploitation scenario, not a theoretical one.
What the vulnerability is
CVE-2026-65400 is a CVSS 9.8 authentication bypass in the macOS Screen Sharing service. The flaw is in the Secure Remote Password (SRP) implementation: an error in frame-length validation causes the service to return an outdated success status, which causes it to treat an unauthenticated connection as legitimate. Any attacker on the network who can reach port 5900 can log in as any account without knowing the password and obtain root access. No user interaction is required. No credentials are needed.
Why rotating your VNC password does nothing
This is a pre-auth flaw. The authentication check is bypassed before VNC credentials are evaluated. Disabling legacy VNC password authentication, rotating the VNC password, or removing allowed user accounts from Screen Sharing has no effect. The only remediation is applying the patch: macOS Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9.
How the attack works in practice
Huntress and Malwarebytes both published technical breakdowns after Apple released the patch. A public proof-of-concept appeared on X from researcher @calif_io, reverse-engineered from Apple's August 6 patch to understand the root cause. The PoC makes exploitation straightforward for anyone with network access to port 5900. The Dutch NCSC noted that exploitation began roughly a week after Apple's patch, consistent with the timeline for weaponizing a public PoC. The attack chain: find a Mac with port 5900 open, connect via Screen Sharing, bypass SRP auth, land as root, install XMRig or equivalent miner.
What to do now
Update immediately to macOS Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9. If your Mac had port 5900 exposed to the internet at any point since August 6, treat the system as potentially compromised: look for unexpected processes (particularly XMRig), check cron jobs and launchd entries for persistence, and consider a clean reinstall if the system had access to sensitive credentials or secrets. Disable Screen Sharing entirely if you do not actively use it. For organizations managing macOS fleets, verify patch status on every device and confirm port 5900 is not exposed externally on any host.
The broader pattern
Internet-facing VNC has been a target for years, but the combination of a pre-auth bypass and a public PoC makes this unusually dangerous for a consumer-facing operating system. The fast exploitation timeline (patch on August 6, PoC available shortly after, exploitation confirmed by August 12) reflects a pattern CrowdStrike documented in their 2026 Threat Hunting Report: 88% of vulnerability exploitation involving a public PoC now occurs within 48 hours of disclosure. The time between patch and working exploit is compressing. If you are not patching within days, you are patching after attackers are already looking for you.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you want to discuss macOS fleet security or vulnerability patching timelines.