Apple macOS Screen Sharing Flaw Exploited to Deploy Monero Miner

A critical vulnerability in Apple's macOS Screen Sharing component is being actively exploited against internet-exposed Mac systems.

Tracked as CVE-2026-65400, the vulnerability carries a CVSS score of 9.8 and can allow an attacker on the network to authenticate to the built-in remote desktop service without valid credentials.

The Netherlands National Cyber Security Centre (NCSC-NL) has reported active exploitation against systems where TCP port 5900 was accessible from the internet. In the observed incidents, attackers gained root access and installed a Monero cryptocurrency miner.

Key Highlights

• Vulnerability: CVE-2026-65400
• CVSS Score: 9.8 Critical
• Product: Apple macOS
• Component: Screen Sharing
• Vulnerability type: Authentication bypass
• Exploitation status: Actively exploited
• Observed attack target: Internet-exposed Macs
• Network port: TCP/5900
• Post-exploitation impact: Root access
• Observed payload: Monero cryptocurrency miner
• Apple patches released for Tahoe, Sequoia and Sonoma
• NCSC-NL confirmed exploitation in the wild.

Vulnerability Overview

CVE-2026-65400 is an authentication issue in Apple's Screen Sharing functionality.

The vulnerability is related to incorrect state management during the authentication process. Under specific conditions, an attacker can cause the Screen Sharing service to incorrectly treat an authentication step as successful.

This can allow an attacker to access the remote desktop service without possessing valid credentials.

Because Screen Sharing can provide privileged access to the underlying system, successful exploitation can result in complete system compromise.

Active Exploitation

The NCSC-NL reported receiving information about active exploitation against multiple systems where Screen Sharing was exposed to the internet through port 5900.

In the observed compromises:

1. Attackers connected to exposed Screen Sharing services.
2. Authentication was bypassed.
3. Root-level access was obtained.
4. A Monero cryptocurrency miner was installed.

The exact scale and duration of the exploitation campaign remain unclear.

Screen Sharing Attack Surface

macOS Screen Sharing provides remote access to Mac systems through Apple's remote desktop functionality.

When exposed directly to the internet, the service becomes an attractive target for automated scanning and exploitation.

Organizations should avoid exposing TCP/5900 directly to the public internet.

Where remote administration is required, access should instead be restricted through trusted VPN, zero-trust or controlled administrative infrastructure.

Related Screen Sharing Vulnerabilities

The Screen Sharing component has been affected by multiple vulnerabilities.

The research also identifies:

• CVE-2026-43779 — Logic issue that could allow an application to intercept network connections intended for another process.
• CVE-2026-43777 — Vulnerability that could allow a remote attacker to cause a denial-of-service condition.
• CVE-2026-43760 — Access-control issue that could expose sensitive information.

CVE-2026-43760 involves a legacy VNC-password authentication path and can potentially turn a file-copy operation into protected file disclosure and arbitrary root-level file creation.

Pre-Authentication Exploitation

Security researchers also identified another pre-authentication issue in the Screen Sharing daemon, screensharingd.

The flaw can allow an attacker to bypass the authentication process without knowing the victim's password.

Research indicated that the attacker only needs the target Mac's IP address when the vulnerable Screen Sharing service is exposed.

The issue was fixed by Apple in macOS 26.6.

Cryptocurrency Mining

The confirmed exploitation reported by NCSC-NL resulted in attackers installing a Monero cryptocurrency miner.

Cryptomining malware consumes CPU resources and can cause:

• High CPU utilization
• Increased electricity consumption
• System performance degradation
• Hardware stress
• Increased network activity

A mining payload also demonstrates that successful exploitation can be converted into persistent post-compromise activity.

Detection and Hunting Opportunities

Security teams should monitor for:

• Internet exposure of TCP/5900
• Unexpected Screen Sharing connections
• Suspicious authentication events involving Screen Sharing
• Unexpected root-level processes
• Unknown processes consuming excessive CPU
• Monero/XMR mining-related activity
• Cryptocurrency mining pool connections
• Unexpected binaries or scripts installed after Screen Sharing access
• Unusual outbound connections from macOS systems
• Unexpected modifications to LaunchAgents or LaunchDaemons
• Suspicious persistence mechanisms
• Unexpected user or administrator accounts
• screensharingd anomalies
• Mac systems initiating connections to cryptocurrency infrastructure

Recommended Mitigations

1. Immediately update vulnerable macOS systems.
2. Install macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, or macOS Sonoma 14.8.9, as applicable.
3. Disable Screen Sharing if it is not required.
4. Do not expose TCP/5900 directly to the internet.
5. Restrict Screen Sharing access to trusted administrative networks.
6. Use VPN or zero-trust access for remote administration.
7. Review firewall rules for internet-accessible VNC/Screen Sharing services.
8. Hunt for unauthorized root processes and cryptocurrency miners.
9. Review systems with historical internet exposure on port 5900.
10. Investigate suspicious Screen Sharing activity before simply removing mining software.
11. Rotate credentials if compromise is suspected.
12. Rebuild compromised systems where root-level persistence cannot be confidently eliminated.

Threat Assessment

CVE-2026-65400 represents a critical remote-access threat because it can bypass authentication and provide attackers with privileged access to vulnerable Mac systems.

The confirmed exploitation and deployment of Monero miners demonstrate that the vulnerability is not merely theoretical.

Internet-exposed Screen Sharing services are particularly high risk because attackers can discover them through automated scanning and attempt exploitation without legitimate credentials.

Conclusion

Organizations should immediately identify macOS systems with Screen Sharing enabled and determine whether TCP/5900 is exposed to untrusted networks.

Affected systems should be patched without delay, while unnecessary Screen Sharing services should be disabled.

Security teams should also perform retrospective hunting on internet-exposed Macs for root-level activity, cryptocurrency mining processes and suspicious persistence mechanisms.