CVE-2026-65400: macOS Screen Sharing Authentication Bypass Grants Unauthenticated Root Access

Key facts for Screen Sharing oversized-frame bypass

Detection coverage for Screen Sharing oversized-frame bypass

As of 2026-08-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1925 across Splunk SPL, Microsoft KQL and Sigma, covering 41 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: screensharingd Root File-Copy Abuse — Cron/LaunchDaemon Write and Shell Spawn (CVE-2026-65400 Post-Exploitation)

Detects screensharingd, running as root, either writing to cron/LaunchDaemon/LaunchAgent locations or spawning a shell/crontab child process — the documented post-bypass path where the file-copy protocol's arbitrary root read/write primitive is used to plant a root crontab entry and/or drop a reverse-shell payload, bypassing TCC entirely since the flaw sits at the pre-auth network layer.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1068, T1005, T1222.002, T1083, T1548.006
• Data sources: osquery file_events, osquery process_events
• Severity: critical
• Confidence: high

Splunk SPL

index=endpoint sourcetype=osquery:results (name="file_events" OR name="process_events")
| where (name="file_events" AND columns.action="created" AND (columns.target_path="/usr/lib/cron/tabs/*" OR columns.target_path="/private/var/at/tabs/*" OR columns.target_path="/Library/LaunchDaemons/*"))
   OR (name="process_events" AND columns.parent_name="screensharingd" AND columns.path IN ("/bin/sh","/bin/bash","/bin/zsh","/usr/bin/crontab"))
| eval username=coalesce(columns.username,"unknown")
| table _time, host, name, columns.parent_name, columns.target_path, columns.path, columns.action, username
| sort - _time

Microsoft KQL

DeviceFileEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "screensharingd"
| where FolderPath has_any ("/usr/lib/cron/tabs", "/private/var/at/tabs", "/Library/LaunchDaemons", "/Library/LaunchAgents")
| where ActionType in ("FileCreated", "FileModified")
| project Timestamp, DeviceName, DeviceId, FolderPath, FileName, InitiatingProcessAccountName, ActionType
| join kind=leftouter (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where InitiatingProcessFileName =~ "screensharingd"
    | where FileName in~ ("sh", "bash", "zsh", "crontab", "nc", "curl")
    | project DeviceId, ChildProcess = FileName, ChildTimestamp = Timestamp
) on DeviceId
| summarize Events = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, FolderPath
| order by Events desc

Sigma

title: Suspicious Child Process or Cron/LaunchDaemon File Write from macOS screensharingd (Post-Exploitation of CVE-2026-65400)
id: 4d6f8b1e-9c3a-4f2d-8e7b-1a5c9d3e7f4b
status: experimental
description: Detects screensharingd (the root-privileged macOS Screen Sharing daemon) spawning shell/utility child processes or writing to cron/LaunchDaemon/LaunchAgent paths, consistent with post-exploitation of the CVE-2026-65400 authentication bypass using the Screen Sharing file-copy protocol to plant a root crontab or persistence artifact.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-65400
    - https://bynar.io/blog/a-root-remote-command-execution-on-macos-with-m5-in-2026
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-07
tags:
    - attack.persistence
    - attack.t1053.003
    - attack.privilege-escalation
    - attack.t1068
    - attack.collection
    - attack.t1005
    - attack.defense-evasion
    - attack.t1222.002
    - attack.discovery
    - attack.t1083
    - cve.2026.65400
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        ParentImage|endswith: '/screensharingd'
        Image|endswith:
            - '/sh'
            - '/bash'
            - '/zsh'
            - '/crontab'
            - '/nc'
            - '/curl'
    condition: selection
falsepositives:
    - None expected under normal operation; screensharingd does not legitimately spawn interactive shells or crontab as children
level: critical

Known false positives:

• None expected during normal operation — screensharingd does not legitimately spawn shells or write cron/LaunchDaemon files; if a sanctioned MDM/Jamf automation does this via a screensharingd-adjacent helper, allowlist that specific parent/child pair rather than suppressing the rule broadly

Tuning notes: Extend the child-process/path list if the fleet uses alternate shells (fish, dash) or transfer utilities (wget, python3 -c, osascript); correlate hits with the exploitation-stage detection (SPL/KQL/SIG-001) within the same host/short window to raise confidence and suppress isolated false positives from unrelated root automation.

• 🔒 [indicator] — Untrusted External Source Completing Screen Sharing Auth on TCP/5900 (CVE-2026-65400) · unlock with TL Creds
• 🔒 [indicator] Root File-Copy Abuse — MDE File/Process Correlation (CVE-2026-65400 Post-Exploitation) · unlock with TL Creds
• 🔒 MDE Correlation: Outbound Connection Within 2 Minutes of Screen Sharing Session on Bypassed Host (CVE-2026-65400) · unlock with TL Creds
• 🔒 Sigma: Anomalous Fast-Completing RFB Authentication on TCP/5900 ([indicator], CVE-2026-65400) · unlock with TL Creds
• 🔒 Sigma: [indicator] Spawning Shell/Crontab Child Process (CVE-2026-65400 Post-Exploitation) · unlock with TL Creds
• 🔒 Sigma: Reverse-Shell/C2 Outbound Connection from screensharingd- or Cron-Spawned Process (CVE-2026-65400) · unlock with TL Creds
• 🔒 [indicator] RFB Auth-Bypass — Abnormally Fast SRP Handshake to TCP/5900 (CVE-2026-65400) · unlock with TL Creds
• 🔒 Reverse-Shell/C2 Callback Following Screen Sharing Auth-Bypass Session (CVE-2026-65400) · unlock with TL Creds

Indicators of compromise for Screen Sharing oversized-frame bypass

As of 2026-08-19, Threadlinqs Intelligence tracks 41 indicators of compromise for TL-2026-1925.

Sample indicators (2 of 41)

• File hash: 0bddb0442a873f7a241d06905152be37ee3f532b72b79e1dcd3b23308a98a3ed
• File hash: 1b42488e77abac660646c459eea324b246069fbde3abe02d6a156e2de9af69db

Defanged, TLP:CLEAR. Full set of 41 indicators: unlock with TL Creds.

How Screen Sharing oversized-frame bypass works

CVE-2026-65400 is an authentication-bypass vulnerability in screensharingd, the root-privileged daemon behind macOS's Screen Sharing feature (Apple's implementation of the VNC/RFB remote-screen-control protocol, listening on TCP/5900). According to Apple's advisory, "an authentication issue was addressed with improved state management"; an attacker on the network could authenticate to Screen Sharing without valid credentials. Independent technical reporting describes the underlying root cause in detail: screensharingd's SRP (Secure Remote Password) authentication routine reads a four-byte, big-endian frame-length field and checks it against a size limit; when an authentication frame is flagged as oversized, the error-handling path returns the leftover success value from a previous read instead of a proper failure code. That stale success value convinces the daemon's state machine that authentication completed even though the SRP exchange never finished, so it skips the password check, the SRP key exchange, and — critically — the key-derivation and cipher-initialization routines that would install encryption. No session keys are ever generated, dropping the connecting client into a fully privileged, unencrypted root session despite Screen Sharing's protocol-level encryption advertisement. Exploitation requires only the target's IP address and network reachability to port 5900; researchers note the resulting proof-of-concept tool "doesn't care about TCC either," i.e. the bypass occurs entirely at the pre-auth network layer and is unaffected by macOS's Transparency, Consent, and Control privacy framework. The same technical writeup separately documents a secondary SRP implementation weakness in the same code path — the client-public-value check rejects only a literal zero rather than verifying congruence to zero modulo the protocol prime — a known class of SRP weakness, though it is reported as a secondary finding distinct from the primary oversized-frame bypass that Apple's fix targets.

Once inside the unauthenticated session, the attacker inherits screensharingd's root privileges and can use Screen Sharing's built-in file-copy protocol to read arbitrary files as root (exposing home folders, logs, application data, and configuration across the disk) and write arbitrary files as root with attacker-controlled contents and permissions. Researchers demonstrated a proof-of-concept that used the write primitive to drop a reverse-shell payload and a root crontab entry within a single TCP connection — leveraging cron's default-enabled status on macOS to achieve automatic root execution within roughly one minute — giving durable, unauthenticated remote code execution as root on any reachable Mac with Screen Sharing enabled. The researchers' own test environment was a Mac mini M4 running macOS 26.3 and 26.4.1 prior to the fix landing in macOS 26.6.

The vulnerability was discovered and reported by researcher Alfredo Pesoli (@__rev) via the Bynario Atlas automated vulnerability-research platform (bynar.io). NVD (scored by CISA-ADP) assigned CVSS 3.1 base score 7.1 (HIGH), vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, and CWE-287 (Improper Authentication); no CVSS v4 score has been published. Apple treated the issue as serious enough to patch macOS Sonoma, Sequoia, and Tahoe simultaneously and out-of-cycle (no beta round) on 2026-08-06/07, shipping macOS Sonoma 14.8.9, macOS Sequoia 15.7.9, and macOS Tahoe 26.6.1. No public exploit tooling or in-the-wild exploitation has been reported, and the CVE does not appear in the CISA Known Exploited Vulnerabilities catalog as of this writing.

This disclosure follows closely on a related but distinct Screen Sharing authorization flaw, CVE-2026-43760 (patched 2026-07-27 in macOS Tahoe 26.6 and Sonoma 14.8.8, also traced to Bynario researchers), in which VNC-password authentication was found to grant the same root-privileged SSFileCopySender/SSFileCopyReceiver helpers used for arbitrary root file read/write, enabling attackers to plant a passwordless-sudo rule via /private/etc/sudoers.d/ and a root-owned LaunchAgent for persistence. Independent researcher fG! (reverse.put.as) publicly criticized Apple's initial CVSS triage of that issue (5.5) as understating real-world impact (researcher assessment 8.0-8.8). The two CVEs are separate root causes in the same subsystem and should not be conflated, but together they indicate a pattern of authentication/authorization weaknesses surfaced in macOS Screen Sharing across mid-2026, with reverse.put.as further warning that many older, no-longer-updated Macs will likely remain exposed on the internet indefinitely.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Lateral Movement

T1021.005 VNC; T1210 Exploitation of Remote Services

Persistence

T1053.003 Cron; T1098 Account Manipulation; T1543 Create or Modify System Process; T1546 Event Triggered Execution

Execution

T1059.004 Unix Shell

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1548.003 Abuse Elevation Control Mechanism

Discovery

T1083 File and Directory Discovery

Command and Control

T1105 Ingress Tool Transfer

Initial Access

T1133 External Remote Services; T1190 Exploit Public-Facing Application

Defense Evasion

T1211 Exploitation for Defense Evasion

defense-impairment

T1222.002 Linux and Mac Permissions

Impact

T1496 Resource Hijacking

privilege-escalation

T1548.006 TCC Manipulation

Reconnaissance

T1595.002 Vulnerability Scanning

Remediation for Screen Sharing oversized-frame bypass

Patches

• macOS Sonoma 14.8.9
• macOS Sequoia 15.7.9
• macOS Tahoe 26.6.1

Immediate actions

• Update affected Macs to macOS Sonoma 14.8.9, macOS Sequoia 15.7.9, or macOS Tahoe 26.6.1
• If patching is delayed, disable Screen Sharing / Remote Management under System Settings > General > Sharing

Workarounds

• Disable Screen Sharing entirely if remote screen control is not required
• Block inbound TCP/5900 at the network perimeter/host firewall for machines that must keep Screen Sharing enabled

Longer-term hardening

• Restrict Screen Sharing/Remote Management to trusted, segmented networks or require VPN access rather than exposing TCP/5900 on general LANs or the internet
• Monitor screensharingd activity and macOS unified logs for anomalous or malformed Screen Sharing authentication frames
• Inventory and retire or isolate older/unsupported Macs that can no longer receive Screen Sharing security patches

Affected and fixed versions

• Apple — macOS Sonoma
  Vulnerable versions: versions prior to 14.8.9
  Fixed in: 14.8.9
• Apple — macOS Sequoia
  Vulnerable versions: versions prior to 15.7.9
  Fixed in: 15.7.9
• Apple — macOS Tahoe
  Vulnerable versions: versions prior to 26.6.1
  Fixed in: 26.6.1

Timeline of Screen Sharing oversized-frame bypass

Last updated 2026-08-19 · 5 updates · revalidated 5× · latest source

Showing the 20 most recent tracked events.

• 2026-08-02 bl4sty's RCE PoC work is clarified to scope the cron-based persistence path to systems with System Integrity Protection disabled, while noting the LaunchDaemon and shell-startup (.zshenv) persistence paths are not so limited.
• 2026-08-02 bl4sty develops working arbitrary file read/write and remote-code-execution PoC variants, demonstrating root RCE via a dropped reverse-shell payload triggered by a root crontab entry.
• 2026-08-03 Reporting (techtimes.com) states Apple's bug-bounty program had an AI-assisted submission cap that blocked formal reporting of the flaw before Vilaça's public disclosure, cited as a factor in the researcher's decision to go public.
• 2026-08-03 A technical writeup (emsi.me) details the locked-ioc-29 root cause of CVE-2026-65400: an oversized authentication frame triggers a stale leftover-success-code response in the SRP handshake that bypasses password check, key derivation, and cipher initialization, leaving the session unencrypted; it also flags a secondary SRP client-public-value validation weakness in the same code path.
• 2026-08-06 9to5Mac, OSXDaily, iClarified, ShiftDelete.Net, mactrast, and Cyber Kendra report on the Screen Sharing authentication-bypass patch, citing researcher Alfredo Pesoli's discovery via locked-ioc-31.
• 2026-08-06 Apple ships out-of-cycle security updates locked-ioc-22, locked-ioc-20, and locked-ioc-23, patching CVE-2026-65400 without prior beta testing, adding frame-length validation to locked-ioc-29.
• 2026-08-06 NVD publishes the CVE-2026-65400 record, describing the issue as improved state management for an authentication issue in Screen Sharing (CWE-287), CVSS 3.1 base score 7.1 (HIGH).
• 2026-08-07 CISA-ADP assigns CVE-2026-65400 a CVSS 3.1 base score of 7.1 (HIGH), vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, via NVD.
• 2026-08-07 locked-ioc-38 publishes a companion security bulletin, "Apple macOS Security Restriction Bypass Vulnerability," on CVE-2026-65400.
• 2026-08-07 locked-ioc-35 publishes Security Alert A26-08-10 covering CVE-2026-65400 and directing users to apply Apple's patches.
• 2026-08-08 Huntress publishes a detailed technical breakdown of the full pre-auth-to-root attack chain (CVE-2026-43760 and CVE-2026-65400), including Endpoint Security Framework detection guidance and a note that bare-metal Mac cloud-hosting providers commonly expose Screen Sharing to the internet by default.
• 2026-08-08 GBHackers and Cyberpress publish additional news coverage summarizing the pre-auth RCE exploit chain (locked-ioc-30 / bl4sty weaponization) and urging Mac administrators to patch.
• 2026-08-09 Media coverage (Forbes and others) highlights the scale of internet-facing exposure, citing tens of thousands of Censys-indexed vulnerable macOS Screen Sharing hosts.
• 2026-08-10 Independent researcher Calif reverse-engineers the macOS 26.6.1 patch and publishes "No Country for Old Passwords," confirming a reliable pre-auth root exploit while withholding full protocol-level exploitation detail.
• 2026-08-12 NCSC-NL updates advisory NCSC-2026-0280 to version 1.0.1, formally confirming active real-world exploitation on multiple internet-exposed Macs, with root access obtained and a Monero miner deployed in every confirmed case.
• 2026-08-14 CISA rescores CVE-2026-65400 from CVSS 3.1 base score 7.1 to 9.8 CRITICAL to reflect confirmed active, automatable exploitation; reported by Tom's Hardware, BleepingComputer, and SC World.
• 2026-08-14 BleepingComputer reports that the Dutch NCSC notified Apple of active in-the-wild abuse of CVE-2026-65400 against internet-exposed systems, with attackers gaining root access and deploying a Monero cryptocurrency miner.
• 2026-08-15 The Hacker News reports independent internet-wide scanning by @osxreverser (Pedro Vilaça) identifying roughly 40,000 internet-exposed Screen Sharing hosts, nearly half in the United States and mostly residential IPs alongside university and corporate infrastructure; also notes security firm Calif built working exploits for two related pre-auth Screen Sharing vulnerabilities within four hours using AI-assisted exploit development.
• 2026-08-17 Malwarebytes Labs publishes a consumer-facing advisory urging Mac users to update immediately given confirmed in-the-wild exploitation.
• 2026-08-18 CISA adds CVE-2026-65400 to the Known Exploited Vulnerabilities Catalog as part of a four-vulnerability batch, setting a federal remediation due date of 2026-08-21.

Update history

• 2026-08-19 — macOS Screen Sharing Pre-Auth Root RCE (CVE-2026-43760, CVE-2026-65400) — Patched, Public PoC, Actively Exploited to Deploy Monero Miners: What changed No severity/exploitability/status escalation — the record was already CRITICAL / CVSS 9.8 / ACTIVE. Adds CVE-2026-43760 and CWE-284 to the tracked set (same combined exploit chain, previously tracked as a separate related CVE),
• 2026-08-17 — macOS Screen Sharing Authentication Bypass (CVE-2026-65400) Exploited in the Wild for Root Access and Monero Mining: What changed CVSS 3.1 base score escalated 7.1 → 9.8 (CRITICAL) after CISA rescored the vulnerability on 2026-08-14 to reflect confirmed active, automatable exploitation. Severity/exploitability/status were already CRITICAL/ACTIVE/ACTIVE fr
• 2026-08-15 — Active Exploitation of macOS Screen Sharing Authentication Bypass (CVE-2026-65400) to Deploy Monero Miner: What changed Exploitability escalated POC_PUBLIC → ACTIVE: NCSC-NL notified Apple of confirmed in-the-wild exploitation of CVE-2026-65400, with attackers gaining root access on internet-exposed Macs and deploying a Monero (XMR) miner (Bleep
• 2026-08-10 — Apple macOS Screen Sharing Pre-Authentication Bypass Enabling Root Access (CVE-2026-65400): What changed No severity/exploitability/status fields were escalated — the newer report's severity_level (HIGH) and status (PATCHED) would downgrade the existing CRITICAL/ACTIVE record and are not applied under escalation-only policy. Subst
• 2026-08-09 — CVE-2026-65400: Pre-Auth macOS Screen Sharing RCE via locked-ioc-29 SRP Authentication Bypass: What changed Severity HIGH → CRITICAL: the newer report supplies concrete evidence of a named public PoC ("locked-ioc-30", released by fG!/Pedro Vilaça 2026-07-29) that a second researcher (bl4sty) reverse-engineered and weaponized into wor

Sources cited for Screen Sharing oversized-frame bypass

• GovCERT.HK Security Alert A26-08-10: Vulnerability in Apple Products govcert.gov.hk · Advisory · 2026-08-07
• HKCERT Security Bulletin: Apple macOS Security Restriction Bypass Vulnerability hkcert.org · Advisory · 2026-08-07
• About the security content of macOS Sequoia 15.7.9 - Apple Support Apple · Vendor report · 2026-08-06
• About the security content of macOS Tahoe 26.6.1 - Apple Support Apple · Vendor report · 2026-08-06
• About the security content of macOS Sonoma 14.8.9 - Apple Support Apple · Vendor report · 2026-08-06
• NVD - CVE-2026-65400 Detail NVD (NIST) · Research · 2026-08-06
• One Oversized Packet Was Enough to Skip Apple's Screen Sharing Login emsi.me · Research · 2026-08-03
• It's a pre-auth, stupid! reverse.put.as · Blog · 2026-07-29
• A root remote command execution on macOS with M5 in 2026? bynar.io · Blog · 2026-07-27
• Apple's latest macOS updates address a serious Screen Sharing vulnerability 9to5mac.com · News · 2026-08-06
• Security Updates MacOS Tahoe 26.6.1, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9 Released for Mac osxdaily.com · News · 2026-08-06
• Apple Releases macOS Tahoe 26.6.1, Sequoia 15.7.9, Sonoma 14.8.9 to Fix Screen Sharing Vulnerability iclarified.com · News · 2026-08-06
• Apple Releases Critical macOS Update to Fix Screen Sharing Vulnerability en.shiftdelete.net · News · 2026-08-06
• macOS Tahoe 26.6.1 Now Available - Brings Security Fixes mactrast.com · News · 2026-08-06
• macOS Screen Sharing Bug Handed Hackers Root, No Password cyberkendra.com · News · 2026-08-06

Threats related to Screen Sharing oversized-frame bypass

• CVE-2026-43760: macOS Screen Sharing Logic Flaw Allows VNC-Authenticated Root Command Execution