Summary
- CVE-2026-65400 allows access to macOS Screen Sharing without valid credentials on affected systems.
- Exploitation requires Screen Sharing to be enabled and TCP port 5900 to be reachable from the internet.
- The Dutch NCSC has now observed successful attacks resulting in root access and cryptomining installation.
The Netherlands’ National Cyber Security Centre has confirmed active exploitation of a macOS Screen Sharing vulnerability after attackers gained root access to exposed systems and installed cryptomining software.
CVE-2026-65400 affects authentication in Apple’s Screen Sharing functionality. On vulnerable systems, an attacker can obtain access without valid login credentials, although the NCSC says successful internet-based exploitation depends on Screen Sharing being enabled and TCP port 5900 being reachable from the public internet.
The Dutch authority first warned about the flaw on 7 August, when it said there were no reports of active exploitation. It changed that assessment on 13 August after observing attacks affecting systems in the vulnerable macOS branches.
The NCSC specifically lists macOS Sequoia 15.7.9, Sonoma 14.8.9 and Tahoe 26.6.1 in its updated warning and advises organisations to install Apple’s available security updates immediately.
Root access changes the operational significance of the flaw considerably. Cryptomining was the payload observed in the attacks, but control at that privilege level is not limited to consuming processing capacity. A successful intruder can potentially establish persistence, interfere with security controls, access protected information or use the machine as a route into connected infrastructure.
The new exploitation evidence follows the earlier analysis of the Screen Sharing authentication flaw, which described Apple’s confirmed authentication bypass alongside independent research showing a deeper pre-authentication exploitation path. At that point, malicious use had not been established.
Remote administration creates a recurring exposure problem because the affected service is designed to provide powerful access in the first place. When its authentication boundary fails, the attacker does not necessarily need to assemble a long chain of weaknesses to reach functionality that an administrator would ordinarily use legitimately.
The condition that port 5900 must be internet-reachable limits the affected population, but hosted Mac environments, development infrastructure and remotely managed systems can be configured differently from ordinary employee laptops. A machine deployed as a remote build host or specialist workstation may expose administrative services deliberately in ways that are less common on a typical office endpoint.
The episode also shows the limits of using severity scores in isolation. CVE-2026-65400 carries a CVSS score of 7.1, below the threshold commonly associated with critical vulnerabilities, yet unauthenticated remote access combined with confirmed root-level compromise gives an exposed system a much more immediate operational risk.
Patch deployment and compromise assessment now have to be treated separately. Installing the corrected macOS build removes the known authentication weakness, but a system that was exposed before the update may require examination for unexpected accounts, processes, persistence and outbound connections.
That distinction is especially relevant where Macs are used for software development or other privileged workflows. A compromised build host can hold source code, signing credentials, API keys and access to development platforms, extending the consequences beyond the individual endpoint.
The NCSC’s update therefore turns a vulnerability story into an incident-response issue for organisations that exposed Screen Sharing during the vulnerable period. The cryptominer is visible evidence of what attackers chose to deploy in observed cases; the root access that allowed it is the more consequential capability.
