NCSC-2026-0280 [1.00] [M/H] Vulnerability fixed in macOS Screen Sharing by Apple

unknownpublic exploitCVE-2026-65400

Apple has fixed a vulnerability in the Screen Sharing feature of macOS versions Sequoia 15.7.9, Sonoma 14.8.9 and Tahoe 26.6.1. The vulnerability concerns an authentication issue in the Screen Sharing functionality whereby network attackers can gain access without valid credentials. This is made possible by insufficient state management during the authentication process. This allows unauthorized individuals to perform authentication attempts that would normally not be accepted.

CSIRTS triage

vendor: Apple product: macOS Screen Sharing Authentication bypassaffected: Sequoia 15.7.9, Sonoma 14.8.9, Tahoe 26.6.1

What: Insufficient state management in Screen Sharing authentication allows attackers to bypass authentication without valid credentials.
Who is affected: Users running the affected macOS versions are at risk.
Urgency: Moderate; network attackers can gain unauthorized access but the vulnerability is not currently exploited in the wild.
Action: Update to the fixed macOS versions provided by Apple.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch macOS Screen Sharing

Get an email when a new macOS Screen Sharing advisory drops — max one per day, one-click unsubscribe.

Details

Source: NCSC-NL Advisories (NL · national-cert · site)
Severity: unknown
Published: 2026-08-07
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0280

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Exploitation confirmedCVE-2026-65400Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 52% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-65400	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

unknownexploitedApple security advisory (AV26-823) – Update 1cccs
highexploitedCISA Adds Four Known Exploited Vulnerabilities to Catalogcisa
criticalexploitedCVE-2026-65400: Apple macOS Improper Authentication Vulnerabilitycisa-kev
high[NEW] [medium] Apple macOS (Sonoma, Sequoia and Tahoe): Vulnerability enables security feature bypasscert-bund
unknownexploitedNCSC-2026-0280 [1.01] [M/H] Vulnerability patched in macOS Screen Sharing by Applencsc-nl
unknownexploitedApple macOS Security Restriction Bypass Vulnerabilityhkcert
unknownVulnerability in Apple macOS (August 07, 2026)cert-fr-avis
highCVE-2026-65400: An authentication issue was addressed with improved state management. This issue is fixed in m…nvd

Recent advisories for macOS Screen Sharing

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownexploitedNCSC-2026-0280 [1.01] [M/H] Vulnerability patched in macOS Screen Sharing by Applencsc-nl · 2026-08-12