A critical vulnerability in macOS’s built-in Screen Sharing service is being actively exploited by attackers to gain root-level access to compromised systems. This flaw, identified as CVE-2026-65400, allows unauthorized users to bypass authentication mechanisms, enabling them to execute arbitrary code with elevated privileges. ([tomshardware.com](https://www.tomshardware.com/tech-industry/cyber-security/macos-screen-sharing-flaw-exploited-to-root-macs-and-plant-monero-miners?utm_source=openai))
The exploitation of this vulnerability has led to the deployment of Monero cryptocurrency miners on affected Macs. Attackers utilize the Screen Sharing service to transfer malicious tools, establish persistent access through SSH keys, and manipulate system settings to evade detection. These actions not only degrade system performance but also pose significant security risks, including potential data theft and further system compromise. ([techradar.com](https://www.techradar.com/pro/security/macos-users-warned-to-beware-screen-sharing-bug-which-can-turn-macs-into-cryptomining-slaves?utm_source=openai))
Apple has responded by releasing security updates for macOS versions Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9 to address this vulnerability. Users are strongly advised to install these updates promptly to mitigate the risk of exploitation. Additionally, disabling the Screen Sharing feature when not in use and blocking port 5900 on routers or firewalls can provide further protection against unauthorized access. ([macworld.com](https://www.macworld.com/article/3208191/apple-fixes-screen-sharing-vulnerability-with-macos-26-6-1-update.html?utm_source=openai))
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has elevated the severity score of this vulnerability to 9.8 out of 10, underscoring the critical nature of the threat. This escalation reflects the ease with which the exploit can be automated and the lack of required prior privileges for successful execution. ([tomshardware.com](https://www.tomshardware.com/tech-industry/cyber-security/macos-screen-sharing-flaw-exploited-to-root-macs-and-plant-monero-miners?utm_source=openai))
This incident highlights the importance of timely software updates and vigilant system monitoring. Organizations and individual users must prioritize the application of security patches and adopt proactive measures to secure remote access services. As cyber threats continue to evolve, maintaining robust security practices is essential to protect against unauthorized access and potential system compromises.
