A critical security vulnerability in Apple's macOS Screen Sharing feature is now under active exploitation to deploy cryptocurrency mining software, according to a warning issued by the Netherlands National Cyber Security Centre. The flaw, tracked as CVE-2026-65400 and carrying a severity score of 9.8 out of 10, allows attackers already on a network to bypass authentication and gain access to the built-in remote desktop service without valid credentials. Apple addressed the issue through emergency updates released earlier this month for macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9.

The Dutch cybersecurity agency reported receiving evidence that attackers exploited the vulnerability across multiple systems where port 5900 was accessible from the internet. In every case, attackers gained root access to the affected machines and installed a Monero cryptocurrency miner. The vulnerability was one of several flaws in the Screen Sharing Server component patched by Apple, including CVE-2026-43779 (scored 9.8), a logic issue allowing apps to intercept network connections meant for other processes; CVE-2026-43777 (scored 7.5), which could enable remote denial-of-service attacks; and CVE-2026-43760 (scored 8.6), an access issue permitting apps to reach user-sensitive data. Security researcher @osxreverser noted that a recent scan identified roughly 40,000 open Screen Sharing hosts on the internet, with nearly half located in the United States, including many at universities and companies.

According to security researcher Alfredo Pesoli of Bynario, who discovered and reported CVE-2026-43760, that flaw is a post-authentication bug requiring the target Mac to have Screen Sharing or Remote Management enabled with VNC password access configured. However, the real concern is the pre-authentication vulnerability CVE-2026-65400, which @osxreverser described as allowing attackers to compromise any Mac with Screen Sharing enabled without knowing the password—only the IP address is needed. Both vulnerabilities are logic bugs residing in the same source code file, according to security firm Calif, which characterized the exploits as requiring "one or two packets in the right order" to grant access. "The first bug does not even need that," Calif noted, referring to how CVE-2026-65400 doesn't require even a username, unlike the second flaw.

The vulnerabilities exploit weaknesses in how macOS Screen Sharing handles authentication states, turning what should be simple file operations into pathways for remote root command execution. Pesoli explained that the post-authentication bug involves a legacy VNC password authentication path where "after the VNC authentication step, we cross a boundary the password was never supposed to cross," enabling attackers to read protected files as root and create attacker-controlled files with root privileges. The pre-authentication flaw is even simpler: a wrong return value from a length check that bails out early on an oversized frame, which the system misreads as successful authentication, advancing the state machine inappropriately. Calif revealed it developed working exploits for both flaws in just four hours using an artificial intelligence agent, demonstrating how AI is shrinking the window between vulnerability discovery and weaponization.

Users should update their systems immediately to the latest macOS version to protect against these exploits, the Dutch cybersecurity agency warned. If immediate patching isn't possible, Apple recommends disabling Screen Sharing by navigating to General > Sharing and toggling Screen Sharing off under "Content & Media." The report notes that both vulnerabilities work reliably on the first attempt against every unpatched machine with Screen Sharing enabled, requiring no sophisticated techniques like heap grooming or defeating address space layout randomization—just sending packets in the correct sequence. Organizations that must expose remote desktop services should place them behind SSH tunneling rather than directly on the internet, @osxreverser advised. The deployment of cryptominers in real-world attacks highlights how quickly adversaries moved from patch release to active exploitation, though details on whether the flaw was exploited as a zero-day before Apple's fix remain unavailable. Enterprises relying on remote management tools face a strategic choice between operational convenience and attack surface reduction, particularly as automated exploit development continues accelerating the threat timeline.