Summary
- Apple says CVE-2026-65400 could allow a network attacker to authenticate to Screen Sharing without valid credentials.
- Huntress says the same underlying flaw can be developed into pre-authentication remote code execution on supported macOS versions.
- Apple released patched Tahoe, Sequoia, and Sonoma builds on 6 August, while public proof-of-concept research increases exposure for systems left unpatched.
Apple has released macOS updates for a Screen Sharing vulnerability that can allow authentication without valid credentials, while independent researchers say the underlying flaw can be taken further to achieve pre-authentication remote code execution on vulnerable systems.
The issue, CVE-2026-65400, affects Apple’s Screen Sharing service. In its security advisories, Apple says an attacker on the network may be able to authenticate to Screen Sharing without valid credentials and describes the remediation as improved state management.
Huntress has published a more detailed independent analysis of the vulnerability. Its researchers traced the weakness to the Screen Sharing service’s implementation of Secure Remote Password authentication and said an error can cause a connection to be treated as authenticated when it is not.
Huntress says the flaw can ultimately be developed into pre-authentication remote code execution on supported macOS releases. The firm tested the issue against a Screen Sharing service even where legacy VNC authentication was disabled and no local Apple accounts had been enabled for remote access.
The distinction between the two descriptions should remain explicit. Apple confirms an authentication bypass. Huntress goes further by describing an exploitation path capable of reaching code execution. There is no confirmed evidence in the sources reviewed by Cyber Insider that the vulnerability is being exploited maliciously in the wild.
Apple released patched versions on 6 August: macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. Huntress says earlier builds in those supported branches are affected by the publicly described pre-authentication issue.
The vulnerability sits in a remote-administration service rather than an ordinary desktop application, making network reachability central to its consequence. Screen Sharing allows another computer to view and control a Mac and uses the Remote Framebuffer protocol associated with VNC-style remote access.
In a conventional office environment, that service may be limited to internal administration. Hosted and remotely provisioned Mac hardware changes the exposure model, however. Macs are increasingly used as remote build systems, development machines, specialist workloads, and on-demand infrastructure where Screen Sharing and SSH can be part of routine administration.
Huntress specifically highlighted hosted bare-metal Apple devices as one environment where Screen Sharing may be enabled. In those settings, a flaw that operates before normal credential validation reaches the administrative boundary rather than requiring an attacker to arrive with a working account.
The August disclosure also follows research into a separate Screen Sharing vulnerability, CVE-2026-43760. Huntress stresses that the two flaws are distinct. The earlier issue depended on an authenticated session under the conditions described by researchers, whereas CVE-2026-65400 concerns the authentication mechanism itself.
That proximity creates scope for confusion during remediation. Applying an update associated with the earlier Screen Sharing issue does not substitute for installing the 6 August releases that address CVE-2026-65400.
Public proof-of-concept material raises the practical exposure of systems that remain on vulnerable builds, although availability of a proof of concept does not establish active criminal exploitation.
No threat actor, victim organisation, or campaign has been tied to CVE-2026-65400 in the evidence reviewed for this article. The current picture is therefore a confirmed Apple authentication flaw, public independent research describing a more serious exploitation path, and security updates covering Apple’s supported macOS branches.
For remotely administered Macs, the consequence depends heavily on whether Screen Sharing is enabled and reachable from an attacker-controlled network. Where it is, the flaw sits ahead of the credential boundary normally relied on to protect remote access.
