NCSC-2026-0280 [1.01] [M/H] Vulnerability patched in macOS Screen Sharing by Apple
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
Apple has patched a vulnerability in the Screen Sharing feature of macOS versions Sequoia 15.7.9, Sonoma 14.8.9 and Tahoe 26.6.1. The vulnerability concerns an authentication issue in the Screen Sharing functionality whereby network attackers can gain access without valid credentials. This is made possible by insufficient state management during the authentication process. As a result, unauthorized parties can perform authentication attempts that would normally not be accepted. Update: The NCSC has received notification that active exploitation of this vulnerability has been observed on multiple systems where port 5900 was accessible from the internet. In all these cases, root access was obtained on the affected system and a Monero crypto miner was placed.
CSIRTS triage
- What
- An authentication bypass vulnerability in macOS Screen Sharing due to insufficient state management allows network attackers to gain root access without credentials.
- Who is affected
- Systems with port 5900 exposed to the internet running affected macOS versions are at risk.
- Urgency
- Critical; active exploitation observed in the wild resulting in root compromise and crypto miner deployment.
- Action
- Update to patched macOS versions and restrict network access to port 5900.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch macOS Screen Sharing
Get an email when a new macOS Screen Sharing advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0280
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation confirmedCVE-2026-65400Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 52% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-65400 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- unknownexploitedApple security advisory (AV26-823) – Update 1cccs
- highexploitedCISA Adds Four Known Exploited Vulnerabilities to Catalogcisa
- criticalexploitedCVE-2026-65400: Apple macOS Improper Authentication Vulnerabilitycisa-kev
- high[NEW] [medium] Apple macOS (Sonoma, Sequoia and Tahoe): Vulnerability enables security feature bypasscert-bund
- unknownNCSC-2026-0280 [1.00] [M/H] Vulnerability fixed in macOS Screen Sharing by Applencsc-nl
- unknownexploitedApple macOS Security Restriction Bypass Vulnerabilityhkcert
- unknownVulnerability in Apple macOS (August 07, 2026)cert-fr-avis
- highCVE-2026-65400: An authentication issue was addressed with improved state management. This issue is fixed in m…nvd
Recent advisories for macOS Screen Sharing
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- unknownNCSC-2026-0280 [1.00] [M/H] Vulnerability fixed in macOS Screen Sharing by Applencsc-nl · 2026-08-07
More from NCSC-NL Advisories
- unknownNCSC-2026-0316 [1.00] [M/H] Vulnerabilities resolved in Oracle PeopleSoft Enterprise2026-08-19
- unknownNCSC-2026-0315 [1.00] [M/H] Vulnerabilities resolved in Oracle MySQL2026-08-19
- unknownNCSC-2026-0314 [1.00] [M/H] Vulnerabilities resolved in Oracle Java SE2026-08-19
- unknownNCSC-2026-0313 [1.00] [M/H] Vulnerabilities resolved in Oracle Business Intelligence Enterprise Edition and Or…2026-08-19
- unknownNCSC-2026-0312 [1.00] [M/H] Vulnerabilities resolved in Oracle Financial Services2026-08-19