CVE-2026-65400: macOS Screen Sharing Authentication Bypass Grants Unauthenticated Root Access

CVE-2026-65400 (TL-2026-1925) is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-08-07 and last reviewed 2026-08-19. It has no confirmed attribution, affects Apple macOS Sonoma, references 2 CVEs (CVE-2026-65400, CVE-2026-43760), maps to 19 MITRE ATT&CK techniques (T1005, T1021.005, T1053.003), and is covered by 9 detection rules and 41 indicators of compromise.

Key facts for TL-2026-1925

Threat ID
TL-2026-1925
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-08-07
Last reviewed
2026-08-19
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
all
Target regions
global
Detection rules
9
Indicators of compromise
41
Updates
2026-08-19 · 5 updates · revalidated 5× · latest source

Malware and tooling in CVE-2026-65400

Malware and tooling: Apple Remote Desktop, Bynario Atlas, VNC

A flaw in screensharingd's handling of oversized authentication frames let a network attacker skip Screen Sharing's password/SRP handshake entirely and obtain a fully privileged, unencrypted root session on macOS Sonoma, Sequoia, and Tahoe. Apple shipped out-of-cycle patches (14.8.9 / 15.7.9 / 26.6.1) on 2026-08-06; no in-the-wild exploitation has been reported.

How CVE-2026-65400 works

CVE-2026-65400 is an authentication-bypass vulnerability in screensharingd, the root-privileged daemon behind macOS's Screen Sharing feature (Apple's implementation of the VNC/RFB remote-screen-control protocol, listening on TCP/5900). According to Apple's advisory, "an authentication issue was addressed with improved state management"; an attacker on the network could authenticate to Screen Sharing without valid credentials. Independent technical reporting describes the underlying root cause in detail: screensharingd's SRP (Secure Remote Password) authentication routine reads a four-byte, big-endian frame-length field and checks it against a size limit; when an authentication frame is flagged as oversized, the error-handling path returns the leftover success value from a previous read instead of a proper failure code. That stale success value convinces the daemon's state machine that authentication completed even though the SRP exchange never finished, so it skips the password check, the SRP key exchange, and — critically — the key-derivation and cipher-initialization routines that would install encryption. No session keys are ever generated, dropping the connecting client into a fully privileged, unencrypted root session despite Screen Sharing's protocol-level encryption advertisement. Exploitation requires only the target's IP address and network reachability to port 5900; researchers note the resulting proof-of-concept tool "doesn't care about TCC either," i.e. the bypass occurs entirely at the pre-auth network layer and is unaffected by macOS's Transparency, Consent, and Control privacy framework. The same technical writeup separately documents a secondary SRP implementation weakness in the same code path — the client-public-value check rejects only a literal zero rather than verifying congruence to zero modulo the protocol prime — a known class of SRP weakness, though it is reported as a secondary finding distinct from the primary oversized-frame bypass that Apple's fix targets.

Once inside the unauthenticated session, the attacker inherits screensharingd's root privileges and can use Screen Sharing's built-in file-copy protocol to read arbitrary files as root (exposing home folders, logs, application data, and configuration across the disk) and write arbitrary files as root with attacker-controlled contents and permissions. Researchers demonstrated a proof-of-concept that used the write primitive to drop a reverse-shell payload and a root crontab entry within a single TCP connection — leveraging cron's default-enabled status on macOS to achieve automatic root execution within roughly one minute — giving durable, unauthenticated remote code execution as root on any reachable Mac with Screen Sharing enabled. The researchers' own test environment was a Mac mini M4 running macOS 26.3 and 26.4.1 prior to the fix landing in macOS 26.6.

The vulnerability was discovered and reported by researcher Alfredo Pesoli (@__rev) via the Bynario Atlas automated vulnerability-research platform (bynar.io). NVD (scored by CISA-ADP) assigned CVSS 3.1 base score 7.1 (HIGH), vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, and CWE-287 (Improper Authentication); no CVSS v4 score has been published. Apple treated the issue as serious enough to patch macOS Sonoma, Sequoia, and Tahoe simultaneously and out-of-cycle (no beta round) on 2026-08-06/07, shipping macOS Sonoma 14.8.9, macOS Sequoia 15.7.9, and macOS Tahoe 26.6.1. No public exploit tooling or in-the-wild exploitation has been reported, and the CVE does not appear in the CISA Known Exploited Vulnerabilities catalog as of this writing.

This disclosure follows closely on a related but distinct Screen Sharing authorization flaw, CVE-2026-43760 (patched 2026-07-27 in macOS Tahoe 26.6 and Sonoma 14.8.8, also traced to Bynario researchers), in which VNC-password authentication was found to grant the same root-privileged SSFileCopySender/SSFileCopyReceiver helpers used for arbitrary root file read/write, enabling attackers to plant a passwordless-sudo rule via /private/etc/sudoers.d/ and a root-owned LaunchAgent for persistence. Independent researcher fG! (reverse.put.as) publicly criticized Apple's initial CVSS triage of that issue (5.5) as understating real-world impact (researcher assessment 8.0-8.8). The two CVEs are separate root causes in the same subsystem and should not be conflated, but together they indicate a pattern of authentication/authorization weaknesses surfaced in macOS Screen Sharing across mid-2026, with reverse.put.as further warning that many older, no-longer-updated Macs will likely remain exposed on the internet indefinitely.

MITRE ATT&CK techniques used in TL-2026-1925

Collection

T1005 Data from Local System

Lateral Movement

T1021.005 VNC; T1210 Exploitation of Remote Services

Persistence

T1053.003 Cron; T1098 Account Manipulation; T1543 Create or Modify System Process; T1546 Event Triggered Execution

Execution

T1059.004 Unix Shell

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1548.003 Abuse Elevation Control Mechanism

Discovery

T1083 File and Directory Discovery

Command and Control

T1105 Ingress Tool Transfer

Initial Access

T1133 External Remote Services; T1190 Exploit Public-Facing Application

Defense Evasion

T1211 Exploitation for Defense Evasion

defense-impairment

T1222.002 Linux and Mac Permissions

Impact

T1496 Resource Hijacking

privilege-escalation

T1548.006 TCC Manipulation

Reconnaissance

T1595.002 Vulnerability Scanning

Affected products and versions in CVE-2026-65400

  • Apple — macOS Sonoma
    Vulnerable versions: versions prior to 14.8.9
    Fixed in: 14.8.9
  • Apple — macOS Sequoia
    Vulnerable versions: versions prior to 15.7.9
    Fixed in: 15.7.9
  • Apple — macOS Tahoe
    Vulnerable versions: versions prior to 26.6.1
    Fixed in: 26.6.1

Remediation for CVE-2026-65400

Patches

  • macOS Sonoma 14.8.9
  • macOS Sequoia 15.7.9
  • macOS Tahoe 26.6.1

Immediate actions

  • Update affected Macs to macOS Sonoma 14.8.9, macOS Sequoia 15.7.9, or macOS Tahoe 26.6.1
  • If patching is delayed, disable Screen Sharing / Remote Management under System Settings > General > Sharing

Workarounds

  • Disable Screen Sharing entirely if remote screen control is not required
  • Block inbound TCP/5900 at the network perimeter/host firewall for machines that must keep Screen Sharing enabled

Longer-term hardening

  • Restrict Screen Sharing/Remote Management to trusted, segmented networks or require VPN access rather than exposing TCP/5900 on general LANs or the internet
  • Monitor screensharingd activity and macOS unified logs for anomalous or malformed Screen Sharing authentication frames
  • Inventory and retire or isolate older/unsupported Macs that can no longer receive Screen Sharing security patches

CVEs associated with CVE-2026-65400

CVE-2026-65400, CVE-2026-43760

Weaknesses (CWE) in CVE-2026-65400

CWE-287, CWE-284

Timeline of CVE-2026-65400

Showing the 20 most recent tracked events.

  • bl4sty's RCE PoC work is clarified to scope the cron-based persistence path to systems with System Integrity Protection disabled, while noting the LaunchDaemon and shell-startup (.zshenv) persistence paths are not so limited.
  • bl4sty develops working arbitrary file read/write and remote-code-execution PoC variants, demonstrating root RCE via a dropped reverse-shell payload triggered by a root crontab entry.
  • Reporting (techtimes.com) states Apple's bug-bounty program had an AI-assisted submission cap that blocked formal reporting of the flaw before Vilaça's public disclosure, cited as a factor in the researcher's decision to go public.
  • A technical writeup (emsi.me) details the screensharingd root cause of CVE-2026-65400: an oversized authentication frame triggers a stale leftover-success-code response in the SRP handshake that bypasses password check, key derivation, and cipher initialization, leaving the session unencrypted; it also flags a secondary SRP client-public-value validation weakness in the same code path.
  • 9to5Mac, OSXDaily, iClarified, ShiftDelete.Net, mactrast, and Cyber Kendra report on the Screen Sharing authentication-bypass patch, citing researcher Alfredo Pesoli's discovery via Bynario Atlas.
  • Apple ships out-of-cycle security updates macOS Sonoma 14.8.9, macOS Sequoia 15.7.9, and macOS Tahoe 26.6.1, patching CVE-2026-65400 without prior beta testing, adding frame-length validation to screensharingd.
  • NVD publishes the CVE-2026-65400 record, describing the issue as improved state management for an authentication issue in Screen Sharing (CWE-287), CVSS 3.1 base score 7.1 (HIGH).
  • CISA-ADP assigns CVE-2026-65400 a CVSS 3.1 base score of 7.1 (HIGH), vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, via NVD.
  • HKCERT publishes a companion security bulletin, "Apple macOS Security Restriction Bypass Vulnerability," on CVE-2026-65400.
  • GovCERT.HK publishes Security Alert A26-08-10 covering CVE-2026-65400 and directing users to apply Apple's patches.
  • Huntress publishes a detailed technical breakdown of the full pre-auth-to-root attack chain (CVE-2026-43760 and CVE-2026-65400), including Endpoint Security Framework detection guidance and a note that bare-metal Mac cloud-hosting providers commonly expose Screen Sharing to the internet by default.
  • GBHackers and Cyberpress publish additional news coverage summarizing the pre-auth RCE exploit chain (navi_the_clown / bl4sty weaponization) and urging Mac administrators to patch.
  • Media coverage (Forbes and others) highlights the scale of internet-facing exposure, citing tens of thousands of Censys-indexed vulnerable macOS Screen Sharing hosts.
  • Independent researcher Calif reverse-engineers the macOS 26.6.1 patch and publishes "No Country for Old Passwords," confirming a reliable pre-auth root exploit while withholding full protocol-level exploitation detail.
  • NCSC-NL updates advisory NCSC-2026-0280 to version 1.0.1, formally confirming active real-world exploitation on multiple internet-exposed Macs, with root access obtained and a Monero miner deployed in every confirmed case.
  • CISA rescores CVE-2026-65400 from CVSS 3.1 base score 7.1 to 9.8 CRITICAL to reflect confirmed active, automatable exploitation; reported by Tom's Hardware, BleepingComputer, and SC World.
  • BleepingComputer reports that the Dutch NCSC notified Apple of active in-the-wild abuse of CVE-2026-65400 against internet-exposed systems, with attackers gaining root access and deploying a Monero cryptocurrency miner.
  • The Hacker News reports independent internet-wide scanning by @osxreverser (Pedro Vilaça) identifying roughly 40,000 internet-exposed Screen Sharing hosts, nearly half in the United States and mostly residential IPs alongside university and corporate infrastructure; also notes security firm Calif built working exploits for two related pre-auth Screen Sharing vulnerabilities within four hours using AI-assisted exploit development.
  • Malwarebytes Labs publishes a consumer-facing advisory urging Mac users to update immediately given confirmed in-the-wild exploitation.
  • CISA adds CVE-2026-65400 to the Known Exploited Vulnerabilities Catalog as part of a four-vulnerability batch, setting a federal remediation due date of 2026-08-21.

Update history for TL-2026-1925

Sources cited for CVE-2026-65400

Threats related to CVE-2026-65400

Detection coverage for TL-2026-1925

As of 2026-08-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1925 across Splunk SPL, Microsoft KQL and Sigma, covering 41 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats