TECH Signal 362
macOS Screen Sharing vulnerability now exploited in the wild with root access and crypto mining
↗
A previously theoretical macOS Screen Sharing vulnerability (CVE-2026-65400) is now being actively exploited in the Netherlands, giving attackers root access and enabling them to install crypto mining software.
Apple already shipped patches for Tahoe, Sequoia, and Sonoma, but any unpatched Mac with Screen Sharing enabled and port 5900 exposed to the internet is vulnerable to full remote compromise without a password. Administrators who cannot patch immediately should disable Screen Sharing in System Settings and ensure port 5900 is not reachable from the public internet.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
The vulnerability lets any network attacker log in as any account without a password when Screen Sharing is enabled.
Dutch cyber security officials confirmed exploitation on multiple systems, with attackers gaining root access and uploading crypto mining software.
Apple has released fixes for macOS Tahoe, Sequoia, and Sonoma; disabling Screen Sharing or closing port 5900 are additional mitigations.
THE CLUSTER