How the macOS Screen Sharing Flaw Lets Attackers Gain Full Root Control

Vulnerability Details

CVE‑2026‑65400 receives a CVSS score of 9.8. The flaw resides in the screensharingd daemon that implements the Secure Remote Password (SRP) protocol. Its frame‑length validator returns a stale success code, causing the connection to be treated as authenticated and leaving the session unencrypted. Because screensharingd runs as root, bypassing authentication grants full system privileges.

Attack Conditions

Scanning at the end of July identified roughly 40,000 Macs with the Screen Sharing service exposed on port 5900, including data‑center Mac mini instances, office machines, and university lab computers. An attacker only needs the target's IP address—no username, password, or other credentials.

Timeline

July 27 – Initial silent patch

Apple released macOS Tahoe 26.6, fixing three Screen Sharing‑related issues, including CVE‑2026‑43760 reported by Bynario. The same day Apple also patched a pre‑authentication remote code execution bug that allows root login without any credentials, discovered independently by @osxreverser.

July 29 – Public disclosure

Bynario published its analysis of CVE‑2026‑43760. @osxreverser posted a blog titled “It’s a pre‑auth, stupid!” and released an obfuscated PoC binary (distributed by navi_the_clown) that can read arbitrary files as root.

August 1‑2 – PoC reverse‑engineered

Researcher bl4sty fully reverse‑engineered the PoC, publishing complete read/write and remote code execution code. The exploit works without disabling System Integrity Protection; sending one or two correctly ordered packets opens the machine.

August 6 – Emergency update

Apple issued out‑of‑band updates for macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9, explicitly fixing CVE‑2026‑65400. The bug differs from CVE‑2026‑43760: the former returns a single‑byte error from a length check, while CVE‑2026‑65400 involves a state‑machine synchronization issue that still requires an account name (effectively a no‑op because macOS displays the username at login). Both are logical flaws; no heap spray, ASLR bypass, or race condition is needed. One or two correctly ordered packets achieve 100 % success.

AI‑Accelerated Weaponization

Four‑hour patch‑to‑weapon

On the same day as the August 6 update, security firm Calif announced they built a full exploit for CVE‑2026‑65400 within four hours. Engineers diffed macOS 26.6 and 26.6.1 binaries to locate the vulnerable code and crafted a complete tool, also weaponizing the pre‑auth bug discovered by @osxreverser.

AI compresses the window

Calif’s blog states the development relied entirely on AI models. Bynario’s discovery of CVE‑2026‑43760 also used an AI‑driven workflow (GPT‑5.5). Apple’s July security bulletin credits Atuin’s discovery engine and Tencent XlabAI for other CVEs, illustrating that AI can accelerate both vulnerability discovery and exploitation.

Wild Exploitation

Active exploitation

NCSC‑NL confirmed active exploitation of CVE‑2026‑65400, receiving multiple reports of compromised Macs with port 5900 exposed. All observed cases show attackers gaining root and installing Monero mining malware.

Port 5900 exposure

Screen Sharing listens on the standard VNC port 5900. When the service is enabled and reachable from the Internet, attackers can scan and attack directly. Cloud providers offering bare‑metal Mac instances often enable SSH and Screen Sharing by default; unpatched images remain vulnerable.

Fixes and Mitigations

Immediate update

Patched versions (released 6 August 2026):

macOS Tahoe 26.6.1

macOS Sequoia 15.7.9

macOS Sonoma 14.8.9

Disable Screen Sharing

If updating is not possible, turn off Screen Sharing via System Settings → General → Sharing → Screen Sharing. Because the flaw is pre‑authentication, traditional hardening such as disabling user accounts, changing VNC passwords, or rotating passwords is ineffective.

Network‑level protection

Place the service behind a VPN.

Configure firewall rules to allow only trusted IPs to reach port 5900.

Avoid exposing the service directly to the Internet.

Detection and Investigation

Endpoint security event monitoring

macOS 13 introduced an Endpoint Security event ES_EVENT_TYPE_NOTIFY_SCREENSHARING_ATTACH. Indicators of compromise include: session_username: root – root Screen Sharing sessions are highly suspicious. authentication_type: SRP (plain SRP) – legitimate Apple authentication uses RSA‑SRP.

File‑system event monitoring

Exploitation triggers the SSFileCopySender process to read/write arbitrary system paths; normal Screen Sharing transfers never touch sensitive system locations.

Rapid investigation checklist

Verify whether Screen Sharing is enabled on all Macs.

Scan internal networks for hosts exposing port 5900.

Look for unusually high CPU usage indicative of Monero mining.

Check for unknown cron jobs or LaunchDaemons.