# macOS Screen Sharing lets a network attacker in without credentials

Source: https://startwithidentity.com/cves/cve-2026-65400/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

## What broke

On August 6, 2026 Apple shipped macOS Tahoe 26.6.1, Sequoia 15.7.9 and Sonoma 14.8.9 with a fix in Screen Sharing. Apple's security notes say "an attacker on the network may be able to authenticate to Screen Sharing without valid credentials," and that "an authentication issue was addressed with improved state management." The CWE is CWE-287 (improper authentication), and NVD records a CVSS 3.1 score of 9.8. The flaw was credited to Alfredo Pesoli via Bynario Atlas. Apple lists the same fix again in macOS Tahoe 26.7 and macOS Golden Gate 27, released September 14, 2026, under Screen Sharing Server.

Apple's notes do not say the flaw was exploited. CISA added it to KEV on August 18, 2026, 12 days after the patch, which means CISA had evidence of exploitation in the wild.

## Why it matters

Screen Sharing is a remote desktop. Apple's own help page says a connected user "can open, move, and close files and windows; open apps; and even restart your Mac." The login step is the only thing that decides who gets that control. A bug in its state handling means the check can be skipped, so anyone who can reach the listener gets the remote control that was meant only for listed users, and with it whatever the signed-in user has open: SSO sessions in the browser, admin consoles, chat. Network reach becomes identity.

## What to do

- Update to macOS Tahoe 26.6.1 or later, Sequoia 15.7.9 or Sonoma 14.8.9. Use MDM to report Macs still below those versions.
- Turn Screen Sharing off where it is not needed (System Settings > General > Sharing), and keep Remote Management off on Macs that do not need it.
- Block the Remote Framebuffer port, TCP 5900, at network boundaries and between user segments, so only management hosts can reach it.

## After you patch

- Review Screen Sharing connections from unexpected addresses since August 2026, and treat any you cannot explain as a compromise of the signed-in user: revoke their SSO sessions and rotate their credentials.

## Sources

- [NVD: CVE-2026-65400](https://nvd.nist.gov/vuln/detail/cve-2026-65400)
- [Apple: About the security content of macOS Tahoe 26.6.1](https://support.apple.com/en-us/148170)
- [Apple: About the security content of macOS Sequoia 15.7.9](https://support.apple.com/en-us/148171)
- [Apple: About the security content of macOS Sonoma 14.8.9](https://support.apple.com/en-us/148172)
- [Apple: About the security content of macOS Golden Gate 27](https://support.apple.com/en-us/149035)
- [Apple: Turn Mac screen sharing on or off](https://support.apple.com/guide/mac-help/turn-screen-sharing-on-or-off-mh11848/mac)
- [Apple: TCP and UDP ports used by Apple software products](https://support.apple.com/en-us/103229)
- [CISA Known Exploited Vulnerabilities catalog, added August 18, 2026](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-65400)