[HIGH PRIORITY] macOS Screen Sharing Auth Bypass (CVE-2026-65400)

⚠ HIGH PRIORITY — CISA KEV (Aug 2026). CVE-2026-65400 is an improper-authentication flaw in macOS built-in Screen Sharing. Attackers on the local network log in without valid credentials — Dutch NCSC confirmed active exploitation including root access and cryptominer deployment.

Affected macOS

• macOS versions before Apple's August 2026 security update
• Macs with Screen Sharing or Remote Management enabled in System Settings
• Developer workstations and design Macs on office LAN or home Wi-Fi

Check exposure

sudo systemsetup -getremotelogin
sudo launchctl list | grep -i screensharing
defaults read /Library/Preferences/com.apple.RemoteManagement 2>/dev/null

Patching Method

1. Install macOS security update via System Settings → General → Software Update.
2. Reboot Mac after update completes.
3. Confirm macOS build matches Apple security advisory fixed versions.
4. Disable Screen Sharing if not required: System Settings → General → Sharing.
5. Review /var/log/system.log for Screen Sharing login events from unknown IPs.
6. Rotate local admin and FileVault recovery keys if Mac was on untrusted network.
7. Run EDR/AV scan for Monero miners or persistence agents.

sw_vers
log show --predicate 'process == "screensharingd"' --last 7d | tail -30

Until patched

• Turn off Screen Sharing and Remote Management immediately
• Enable macOS firewall — block all incoming connections
• Do not connect Mac to public Wi-Fi with sharing enabled

CVSS: up to 9.8 Critical. Exploitation confirmed within days of disclosure.