Apple fixed CVE-2026-65400 on August 6 in macOS Tahoe 26.6.1, but the Netherlands’ National Cyber Security Centre (NCSC) warns that public exploit code and active abuse have followed quickly.
CVE-2026-65400 and macOS Screen Sharing
The vulnerability is an authentication bypass in macOS Screen Sharing, the built-in remote desktop feature that implements VNC over TCP port 5900. According to published advisories, the flaw allows a network-based attacker to gain access without valid credentials, meaning an attacker who can reach the Screen Sharing service over the network may be granted access despite not presenting legitimate login information.
Observed attacks: exposed port 5900 and Monero miner deployment
The Dutch agency updated its advisory after receiving a report that the vulnerability is being exploited in the wild where port 5900 is exposed to the Internet. “The NCSC has received a notification indicating that active abuse of this vulnerability has been observed on multiple systems on which port 5900 was accessible from the Internet,” reads the Dutch agency's update. “In all these cases, root had been accessed on the affected system, and a Monero crypto miner had been placed.”
The NCSC says the attacks involved systems with port 5900 reachable from the internet; it has not published details about when the attacks started, whether they extend beyond cryptocurrency mining, or how many systems were affected.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadTechnical impact: what attackers can do through Screen Sharing
Advisories spell out why this type of bypass is serious: once authenticated control is obtained, an attacker can open applications remotely, access files, change security settings, and perform other actions on the compromised system. The NCSC report notes that in the observed incidents the attackers moved from initial access to root-level control and installed a Monero miner — an outcome that demonstrates how quickly a single service exposure can escalate to full-system compromise.
Mitigations: the patched releases and a temporary workaround
Apple issued fixes addressing CVE-2026-65400 in the following releases: macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9. These updates “improve state management mechanisms to enforce correct credential validation and prevent rogue authentication attempts,” according to the advisory language cited in the NCSC notice.
Where immediate updates are not possible, the advisory gives a clear temporary mitigation: use System Settings to disable Screen Sharing (General → Sharing → Screen Sharing) if the feature is not needed. That step removes the exposed service from the network surface until systems can be patched.
What this means for macOS users, security teams, and enterprises
- macOS users: The NCSC recommendation is straightforward — install one of the patched macOS releases listed above, or disable Screen Sharing until you can. Systems with Screen Sharing reachable from the Internet should be treated with urgency given the observed root compromises and miner installations.
- Security teams: The incidents underscore the need to inventory and block internet-reachable services like TCP/5900, monitor for signs of root compromise, and hunt for unauthorized crypto-mining processes. The NCSC’s report that root access was obtained in all observed cases signals that initial prevention can be insufficient once attackers bypass authentication.
- Enterprises and procurement leaders: Review patch-management timelines for macOS hosts, verify that remote-access services are purposefully exposed, and prioritize devices that may have Screen Sharing enabled by default or by legacy configurations.
One analytical note in the advisory material stresses a broader defensive truth: “Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.” The Blue Report 2026, cited alongside that observation, measures defenses technique by technique across 338 million simulations run in customer production environments — a reminder that measured prevention does not eliminate the need for rapid patching and exposure minimization.
The record in this case is simple and stark: public exploit code for CVE-2026-65400 circulated, Apple issued fixes on August 6, and the Netherlands’ NCSC reports active abuse in internet-exposed cases that resulted in root access and Monero miner deployments. The NCSC has not disclosed the scale or timing of the incidents, leaving system owners to act on the specific, published mitigations and the clear evidence that an exposed TCP/5900 can be a route from network reachability to full compromise.
