CVE-2026-65400macOS Screen Sharing lets a network attacker in without credentials
What broke
On August 6, 2026 Apple shipped macOS Tahoe 26.6.1, Sequoia 15.7.9 and Sonoma 14.8.9 with a fix in Screen Sharing. Apple's security notes say "an attacker on the network may be able to authenticate to Screen Sharing without valid credentials," and that "an authentication issue was addressed with improved state management." The CWE is CWE-287 (improper authentication), and NVD records a CVSS 3.1 score of 9.8. The flaw was credited to Alfredo Pesoli via Bynario Atlas. Apple lists the same fix again in macOS Tahoe 26.7 and macOS Golden Gate 27, released September 14, 2026, under Screen Sharing Server.
Apple's notes do not say the flaw was exploited. CISA added it to KEV on August 18, 2026, 12 days after the patch, which means CISA had evidence of exploitation in the wild.
Why it matters
Screen Sharing is a remote desktop. Apple's own help page says a connected user "can open, move, and close files and windows; open apps; and even restart your Mac." The login step is the only thing that decides who gets that control. A bug in its state handling means the check can be skipped, so anyone who can reach the listener gets the remote control that was meant only for listed users, and with it whatever the signed-in user has open: SSO sessions in the browser, admin consoles, chat. Network reach becomes identity.
What to do
- Update to macOS Tahoe 26.6.1 or later, Sequoia 15.7.9 or Sonoma 14.8.9. Use MDM to report Macs still below those versions.
- Turn Screen Sharing off where it is not needed (System Settings > General > Sharing), and keep Remote Management off on Macs that do not need it.
- Block the Remote Framebuffer port, TCP 5900, at network boundaries and between user segments, so only management hosts can reach it.
After you patch
- Review Screen Sharing connections from unexpected addresses since August 2026, and treat any you cannot explain as a compromise of the signed-in user: revoke their SSO sessions and rotate their credentials.
Sources
- NVD: CVE-2026-65400
- Apple: About the security content of macOS Tahoe 26.6.1
- Apple: About the security content of macOS Sequoia 15.7.9
- Apple: About the security content of macOS Sonoma 14.8.9
- Apple: About the security content of macOS Golden Gate 27
- Apple: Turn Mac screen sharing on or off
- Apple: TCP and UDP ports used by Apple software products
- CISA Known Exploited Vulnerabilities catalog, added August 18, 2026
Related on Start with Identity
- CVECheck Point Remote Access VPN lets attackers in without a password over IKEv1
A certificate validation logic flaw in Check Point Remote Access and Mobile Access over deprecated IKEv1 let attackers open a VPN session without a valid passwo
- CVECheck Point SmartConsole login hands an unauthenticated attacker an admin token
A flaw in the Check Point SmartConsole login process let an unauthenticated attacker obtain an application login token and sign in to the Management Server as a
- CVEIvanti Endpoint Manager authentication bypass leaks stored credentials
An authentication bypass in Ivanti Endpoint Manager before 2024 SU5 let an unauthenticated remote attacker read specific stored credential data. Patched Februar
- BlogCISA adds the last two Ivanti Connect Secure chain flaws to KEV after Ivanti's October 29 patch
CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576
- BlogIvanti Connect Secure auth bypass exploited; CISA gave agencies three days
CVE-2026-104935 lets an unauthenticated attacker bypass Ivanti Connect Secure's login with a crafted header and run commands. Exploited since early October by a
- BlogPEERSTITCH implant tags FortiOS VPN sessions to skip security checks
Unit 42 found an in-memory FortiOS implant that patches the IKE daemon so tagged VPN sessions bypass default security validations. Attackers reached root with C