macOS Screen Sharing Flaw Fixed After Wild Exploitation for Crypto Mining

Critical CVE-2026-65400 vulnerability in macOS screen sharing allowed unauthorized root access and Monero mining deployment. Apple issued urgent patches; AI accelerated exploit development to four hours.

Woofun AI reports that the Dutch National Cyber Security Centre warned of active exploitation of a severe authentication flaw in macOS screen sharing, identified as CVE-2026-65400 with a CVSS score of 9.8. Attackers accessed internet-exposed Macs on port 5900 without credentials to install Monero mining software, achieving root access in multiple incidents. Apple deployed urgent fixes on August 6 through macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.

9, enhancing status management and credential verification. Security researcher @osxreverser disclosed a related pre-authentication bypass in the same component, also resolved in version 26.6, which permits access using only the target IP address. Calif researchers utilized AI to generate exploit scripts for both vulnerabilities within four hours, highlighting reduced time from discovery to attack code creation. Users are advised to update immediately or disable screen sharing if updates are unavailable.