# CVE-2026-65400: macOS Screen Sharing Authentication Bypass Grants Unauthenticated Root Access

> A flaw in screensharingd's handling of oversized authentication frames let a network attacker skip Screen Sharing's password/SRP handshake entirely and obtain a fully privileged, unencrypted root session on macOS Sonoma, Sequoia, and Tahoe. Apple shipped out-of-cycle patches (14.8.9 / 15.7.9 / 26.6.1) on 2026-08-06; no in-the-wild exploitation has been reported.

- **Published:** 2026-08-07T00:00:00Z
- **Last reviewed:** 2026-08-19T03:06:15.807Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1925
- **ID:** TL-2026-1925
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 41 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-65400, CVE-2026-43760

## Description

CVE-2026-65400 is an authentication-bypass vulnerability in screensharingd, the root-privileged daemon behind macOS's Screen Sharing feature (Apple's implementation of the VNC/RFB remote-screen-control protocol, listening on TCP/5900). According to Apple's advisory, "an authentication issue was addressed with improved state management"; an attacker on the network could authenticate to Screen Sharing without valid credentials. Independent technical reporting describes the underlying root cause in detail: screensharingd's SRP (Secure Remote Password) authentication routine reads a four-byte, big-endian frame-length field and checks it against a size limit; when an authentication frame is flagged as oversized, the error-handling path returns the leftover success value from a previous read instead of a proper failure code. That stale success value convinces the daemon's state machine that authentication completed even though the SRP exchange never finished, so it skips the password check, the SRP key exchange, and — critically — the key-derivation and cipher-initialization routines that would install encryption. No session keys are ever generated, dropping the connecting client into a fully privileged, unencrypted root session despite Screen Sharing's protocol-level encryption advertisement. Exploitation requires only the target's IP address and network reachability to port 5900; researchers note the resulting proof-of-concept tool "doesn't care about TCC either," i.e. the bypass occurs entirely at the pre-auth network layer and is unaffected by macOS's Transparency, Consent, and Control privacy framework. The same technical writeup separately documents a secondary SRP implementation weakness in the same code path — the client-public-value check rejects only a literal zero rather than verifying congruence to zero modulo the protocol prime — a known class of SRP weakness, though it is reported as a secondary finding distinct from the primary oversized-frame bypass that Apple's fix targets.

Once inside the unauthenticated session, the attacker inherits screensharingd's root privileges and can use Screen Sharing's built-in file-copy protocol to read arbitrary files as root (exposing home folders, logs, application data, and configuration across the disk) and write arbitrary files as root with attacker-controlled contents and permissions. Researchers demonstrated a proof-of-concept that used the write primitive to drop a reverse-shell payload and a root crontab entry within a single TCP connection — leveraging cron's default-enabled status on macOS to achieve automatic root execution within roughly one minute — giving durable, unauthenticated remote code execution as root on any reachable Mac with Screen Sharing enabled. The researchers' own test environment was a Mac mini M4 running macOS 26.3 and 26.4.1 prior to the fix landing in macOS 26.6.

The vulnerability was discovered and reported by researcher Alfredo Pesoli (@__rev) via the Bynario Atlas automated vulnerability-research platform (bynar.io). NVD (scored by CISA-ADP) assigned CVSS 3.1 base score 7.1 (HIGH), vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, and CWE-287 (Improper Authentication); no CVSS v4 score has been published. Apple treated the issue as serious enough to patch macOS Sonoma, Sequoia, and Tahoe simultaneously and out-of-cycle (no beta round) on 2026-08-06/07, shipping macOS Sonoma 14.8.9, macOS Sequoia 15.7.9, and macOS Tahoe 26.6.1. No public exploit tooling or in-the-wild exploitation has been reported, and the CVE does not appear in the CISA Known Exploited Vulnerabilities catalog as of this writing.

This disclosure follows closely on a related but distinct Screen Sharing authorization flaw, CVE-2026-43760 (patched 2026-07-27 in macOS Tahoe 26.6 and Sonoma 14.8.8, also traced to Bynario researchers), in which VNC-password authentication was found to grant the same root-privileged SSFileCopySender/SSFileCopyReceiver helpers used for arbitrary root file read/write, enabling attackers to plant a passwordless-sudo rule via /private/etc/sudoers.d/ and a root-owned LaunchAgent for persistence. Independent researcher fG! (reverse.put.as) publicly criticized Apple's initial CVSS triage of that issue (5.5) as understating real-world impact (researcher assessment 8.0-8.8). The two CVEs are separate root causes in the same subsystem and should not be conflated, but together they indicate a pattern of authentication/authorization weaknesses surfaced in macOS Screen Sharing across mid-2026, with reverse.put.as further warning that many older, no-longer-updated Macs will likely remain exposed on the internet indefinitely.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1133 External Remote Services
- T1021.005 VNC
- T1548.006 TCC Manipulation
- T1222.002 Linux and Mac Permissions
- T1059.004 Unix Shell
- T1053.003 Cron
- T1005 Data from Local System
- T1190 Exploit Public-Facing Application
- T1210 Exploitation of Remote Services
- T1211 Exploitation for Defense Evasion
- T1068 Exploitation for Privilege Escalation
- T1105 Ingress Tool Transfer
- T1543 Create or Modify System Process
- T1546 Event Triggered Execution
- T1083 File and Directory Discovery
- T1496 Resource Hijacking
- T1548.003 Abuse Elevation Control Mechanism
- T1098 Account Manipulation

## Sources

- [GovCERT.HK Security Alert A26-08-10: Vulnerability in Apple Products](https://www.govcert.gov.hk/en/alerts_detail.php?id=2003)
- [HKCERT Security Bulletin: Apple macOS Security Restriction Bypass Vulnerability](https://www.hkcert.org/security-bulletin/apple-macos-security-restriction-bypass-vulnerability_20260807)
- [About the security content of macOS Sequoia 15.7.9 - Apple Support](https://support.apple.com/en-us/148171)
- [About the security content of macOS Tahoe 26.6.1 - Apple Support](https://support.apple.com/en-us/148170)
- [About the security content of macOS Sonoma 14.8.9 - Apple Support](https://support.apple.com/en-us/148172)
- [NVD - CVE-2026-65400 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-65400)
- [Apple's latest macOS updates address a serious Screen Sharing vulnerability](https://9to5mac.com/2026/08/06/apples-latest-macos-updates-address-a-serious-screen-sharing-vulnerability/)
- [Security Updates MacOS Tahoe 26.6.1, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9 Released for Mac](https://osxdaily.com/2026/08/06/security-updates-macos-tahoe-26-6-1-macos-sequoia-15-7-9-macos-sonoma-14-8-9-released-for-mac/)
- [Apple Releases macOS Tahoe 26.6.1, Sequoia 15.7.9, Sonoma 14.8.9 to Fix Screen Sharing Vulnerability](https://www.iclarified.com/101686/apple-releases-macos-tahoe-2661-sequoia-1579-sonoma-1489-to-fix-screen-sharing-vulnerability)
- [Apple Releases Critical macOS Update to Fix Screen Sharing Vulnerability](https://en.shiftdelete.net/apple-releases-critical-macos-update-to-fix-screen-sharing-vulnerability/)
- [macOS Tahoe 26.6.1 Now Available - Brings Security Fixes](https://www.mactrast.com/2026/08/macos-tahoe-26-6-1-now-available-brings-security-fixes/)
- [One Oversized Packet Was Enough to Skip Apple's Screen Sharing Login](https://www.emsi.me/tech/security/one-oversized-packet-was-enough-to-skip-apples-screen-sharing-login/2026-08-03/093a06)
- [It's a pre-auth, stupid!](https://reverse.put.as/2026/07/29/its-a-pre-auth-stupid/)
- [A root remote command execution on macOS with M5 in 2026?](https://bynar.io/blog/a-root-remote-command-execution-on-macos-with-m5-in-2026)
- [macOS Screen Sharing Bug Handed Hackers Root, No Password](https://www.cyberkendra.com/2026/08/macos-screen-sharing-bug-handed-hackers.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1925