Vulnerability record · CVE-2026-65400 · published 6 August 2026
CVE-2026-65400: Apple macOS Screen Sharing authentication bypass
Apple · Macos
An improper authentication flaw in Apple macOS Screen Sharing allows a network attacker to authenticate without valid credentials. Apple fixed it via improved state management across macOS Golden Gate 27, Sequoia 15.7.9, Sonoma 14.8.9, and Tahoe 26.6.1/26.7. It matters because Screen Sharing grants interactive remote control of the host, and the flaw is remotely reachable with no credentials or user interaction.
Description
An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, macOS Tahoe 26.7. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 unauthenticated network authentication bypass in Screen Sharing combined with CISA KEV listing and a near-term remediation deadline makes this an urgent patch.
What it is
An improper authentication flaw in Apple macOS Screen Sharing allows a network attacker to authenticate without valid credentials. Apple fixed it via improved state management across macOS Golden Gate 27, Sequoia 15.7.9, Sonoma 14.8.9, and Tahoe 26.6.1/26.7. It matters because Screen Sharing grants interactive remote control of the host, and the flaw is remotely reachable with no credentials or user interaction.
Impact
An unauthenticated network attacker gains interactive access to the target Mac's Screen Sharing session, effectively remote control of the desktop with the privileges of the logged-in user. CVSS 3.1 scores it 9.8 with high confidentiality, integrity and availability impact.
Attack surface
Reached over the network via the Screen Sharing service (vector AV:N/AC:L/PR:N/UI:N), so no authentication and no user interaction are required. Any Mac with Screen Sharing enabled and reachable on the network is exposed.
Exploitation
CVE-2026-65400 was added to CISA KEV on 2026-08-18 with a remediation due date of 2026-08-21, indicating known exploitation in the wild; EPSS 30-day probability is 0.10461 (95.5th percentile). No ransomware campaign use is documented, and reference tags are vendor advisories, mailing list and government resources only.
What to do
- Patch to the fixed macOS releases: Golden Gate 27, Sequoia 15.7.9, Sonoma 14.8.9, Tahoe 26.6.1 or 26.7, per Apple advisories.
- If patching cannot be completed immediately, disable Screen Sharing (Remote Management/Apple Remote Desktop) on affected hosts.
- Block inbound Screen Sharing (TCP 5900) at network boundaries and restrict it to trusted management networks or VPN.
- Treat KEV due date 2026-08-21 as the remediation deadline and track compliance under BOD 26-04.
- Audit which Macs have Screen Sharing enabled and remove the service where it is not operationally required.
Detection
- Review Screen Sharing/VNC authentication and connection logs for successful sessions from unexpected source IPs or without a matching credential event.
- Alert on inbound TCP 5900 connections from outside trusted management subnets.
- Inventory macOS hosts with Screen Sharing or Remote Management enabled and flag any that are internet-exposed.
- Hunt for anomalous interactive desktop activity, new remote sessions or configuration changes on Macs following unexplained Screen Sharing logins.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2026-65400 to the Known Exploited Vulnerabilities catalog on 18 August 2026 as "Apple macOS Improper Authentication Vulnerability". Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal deadline 21 August 2026.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://support.apple.com/en-us/148170 | Release NotesVendor Advisory |
| https://support.apple.com/en-us/148171 | Release NotesVendor Advisory |
| https://support.apple.com/en-us/148172 | Release NotesVendor Advisory |
| https://support.apple.com/en-us/149035 | Release NotesVendor Advisory |
| https://support.apple.com/en-us/149042 | Release NotesVendor Advisory |
| http://seclists.org/fulldisclosure/2026/Aug/36 | Mailing List |
| http://seclists.org/fulldisclosure/2026/Aug/37 | Broken Link |
| https://advisories.ncsc.nl/2026/ncsc-2026-0280.html | Third Party Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-65400 | US Government Resource |
Track CVE-2026-65400 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2026-65400), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
