A recently disclosed vulnerability in macOS’s Screen Sharing feature has been exploited to execute commands with root privileges, posing a significant security risk to users. This flaw, identified as CVE-2026-43760, affects systems where Screen Sharing or Remote Management is enabled, particularly when the legacy VNC password option is active.
The core issue lies in the handling of authentication methods by the Screen Sharing service. When users connect via Apple’s native authentication, the service correctly assigns user permissions. However, connections made through the older VNC authentication method, which relies solely on a configured password without a corresponding macOS user identity, result in the file-copy helpers—SSFileCopySender and SSFileCopyReceiver—operating with root privileges.
This misconfiguration allows remote users to perform unauthorized actions. For instance, an attacker can request sensitive files like /etc/sudoers through SSFileCopySender, gaining access to protected system configurations. More alarmingly, SSFileCopyReceiver permits the creation of files with specified content and permissions in any directory, including critical system paths.
Security researchers demonstrated the severity of this vulnerability by writing a new file into /private/etc/sudoers.d. By crafting a valid sudoers policy, they granted a non-admin account passwordless sudo access, enabling the execution of commands as root. This exploit was achieved entirely through an authenticated Screen Sharing session without the need for traditional memory corruption techniques.
Apple has addressed this issue in macOS Tahoe 26.6 and macOS Sonoma 14.8.8, both released on July 27, 2026. Users are strongly advised to update their systems promptly. For those unable to update immediately, disabling the “VNC viewers may control screen with password” option or turning off Screen Sharing and Remote Management features is recommended. Merely changing the VNC password does not mitigate the underlying vulnerability.
This incident highlights a growing trend in cybersecurity where attackers exploit logic and authorization flaws, bypassing traditional memory-safety protections. As systems become more secure against conventional attacks, the focus shifts to vulnerabilities arising from misconfigurations and improper privilege management. Users and administrators must remain vigilant, ensuring that all remote access features are configured securely and that systems are kept up to date with the latest security patches.
