CVE-2026-43760: macOS Screen Sharing Logic Flaw Allows VNC-Authenticated Root Command Execution

Key facts for macOS Screen Sharing RCE

Detection coverage for macOS Screen Sharing RCE

As of 2026-08-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2038 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SSFileCopySender Root-Context Read of Protected File Path (CVE-2026-43760 Exploitation)

Detects the Screen Sharing file-copy read helper SSFileCopySender executing with UID 0 while its command line references a protected root-owned path (e.g. /etc/sudoers, /etc/master.passwd, /var/db/dslocal). Under legacy VNC (RFB security type 2) authentication this helper incorrectly retains root privileges instead of dropping to the authenticated user's context, letting an attacker who only knows the VNC password read files an unprivileged session would be denied. This is Phase 1 (StartFileSend) of the CVE-2026-43760 confused-deputy chain.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1133, T1021.005, T1005, T1068
• Data sources: crowdstrike_falcon, osquery_process_events, macos_endpoint_security_esf
• Severity: high
• Confidence: high

Splunk SPL

index=edr sourcetype=crowdstrike:events:sensor event_simpleName=ProcessRollup2
  ImageFileName="*SSFileCopySender*"
| eval uid=UserSid
| where uid="0"
| rex field=CommandLine "(?i)(?<target_path>/etc/sudoers\S*|/etc/master\.passwd|/private/etc/(shadow|sudoers\S*)|/var/db/dslocal/\S*)"
| where isnotnull(target_path)
| eval parent_is_screensharing=if(match(ParentImageFileName, "(?i)screensharingd"), "true", "false")
| stats count min(_time) as first_seen max(_time) as last_seen values(target_path) as protected_paths_read values(CommandLine) as command_lines by ComputerName, UserName, uid, parent_is_screensharing
| where count>0
| sort -count

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where DeviceOS == "macOS"
| where FileName == "SSFileCopySender" or FolderPath has "SSFileCopySender.bundle"
| where AccountName == "root"
| where ProcessCommandLine has_any ("/etc/sudoers", "/etc/master.passwd", "/private/etc/sudoers", "/var/db/dslocal")
| extend ParentIsScreenSharing = InitiatingProcessParentFileName =~ "screensharingd"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessParentFileName, ParentIsScreenSharing, ReportId
| order by Timestamp desc

Sigma

title: macOS Screen Sharing SSFileCopySender Root Read of Protected File (CVE-2026-43760)
id: 7f2a9e3c-4b1d-4a6e-9c2f-1d8e6a5b0c11
status: experimental
description: Detects SSFileCopySender running as root and reading a protected system file path (e.g. /etc/sudoers) via a Screen Sharing StartFileSend command, indicative of CVE-2026-43760 confused-deputy exploitation over legacy VNC authentication.
references:
    - https://bynar.io/blog/a-root-remote-command-execution-on-macos-with-m5-in-2026
    - https://nvd.nist.gov/vuln/detail/CVE-2026-43760
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-17
tags:
    - attack.initial-access
    - attack.t1133
    - attack.lateral-movement
    - attack.t1021.005
    - attack.collection
    - attack.t1005
    - attack.privilege-escalation
    - attack.t1068
    - cve.2026.43760
logsource:
    category: process_creation
    product: macos
detection:
    selection_proc:
        Image|endswith: '/SSFileCopySender'
        User: 'root'
    selection_path:
        CommandLine|contains:
            - '/etc/sudoers'
            - '/etc/master.passwd'
            - '/private/etc/sudoers'
            - '/var/db/dslocal'
    condition: selection_proc and selection_path
falsepositives:
    - Legitimate Apple Remote Desktop / MDM-driven file transfer of the same paths for authorized backup or config-management purposes (rare; verify against change records)
level: high

Known false positives:

• Authorized MDM/backup tooling (e.g. Apple Remote Desktop with native auth) transferring the same protected paths under a verified admin identity

Tuning notes: Baseline expected screensharingd/SSFileCopySender activity per host (MDM-managed Macs may legitimately run authenticated file transfers); tighten the protected-path regex to the organization's sudoers/shadow/dslocal inventory to cut noise, and correlate parent_is_screensharing=true with a concurrent legacy-VNC (not Apple ID) auth event if the EDR exposes it.

• 🔒 SSFileCopySender Root-Context Read of Protected File Path (CVE-2026-43760 Exploitation) · unlock with TL Creds
• 🔒 SSFileCopyReceiver Writes Root-Owned Sudoers.d Policy File (CVE-2026-43760 Post-Exploitation) · unlock with TL Creds
• 🔒 Passwordless Root Shell (sudo -n) Following Screen Sharing VNC Session (CVE-2026-43760 Full Chain / Lateral Pivot) · unlock with TL Creds
• 🔒 SSFileCopySender Root-Context Read of Protected File Path (CVE-2026-43760 Exploitation) · unlock with TL Creds
• 🔒 SSFileCopyReceiver Writes Root-Owned Sudoers.d Policy File (CVE-2026-43760 Post-Exploitation) · unlock with TL Creds
• 🔒 Passwordless Root Shell (sudo -n) Following Screen Sharing VNC Session (CVE-2026-43760 Full Chain / Lateral Pivot) · unlock with TL Creds
• 🔒 SSFileCopyReceiver Writes Root-Owned Sudoers.d Policy File (CVE-2026-43760 Post-Exploitation) · unlock with TL Creds
• 🔒 Passwordless Root Shell (sudo -n) Following Screen Sharing VNC Session (CVE-2026-43760 Full Chain / Lateral Pivot) · unlock with TL Creds

Indicators of compromise for macOS Screen Sharing RCE

As of 2026-08-16, Threadlinqs Intelligence tracks 9 indicators of compromise for TL-2026-2038.

How macOS Screen Sharing RCE works

Apple patched it in macOS Tahoe 26.6 and macOS Sonoma 14.8.8 (2026-07-27); researcher Alfredo Pesoli of Bynar.io published a working technical exploitation chain two days later.

macOS Screen Sharing (screensharingd) supports two authentication modes: native Apple ID/Remote Management authentication, which resolves a macOS user identity and scopes privileges accordingly, and a legacy VNC password method (RFB security type 2) that only proves knowledge of a shared secret and establishes no macOS user identity at all. CVE-2026-43760 is a confused-deputy logic flaw (CWE-284, Improper Access Control): the file-copy helper processes spawned to service Screen Sharing file transfers — SSFileCopySender (reads) and SSFileCopyReceiver (writes) — continue to run as root regardless of which authentication path was used, instead of dropping privileges for VNC-password sessions that have no associated user identity.

Researcher Alfredo Pesoli (@__rev) of Bynar.io/Bynario documented a three-phase exploitation chain in a July 29, 2026 writeup. Phase 1: the attacker issues a StartFileSend command with a protected path such as /etc/sudoers; because SSFileCopySender forwards the viewer-selected path directly ("session->path = send->path") without a permission check and runs as UID 0, the read succeeds where an unprivileged local user would get "Permission denied." Phase 2: the attacker issues a StartFileReceive command specifying an attacker-chosen destination directory, filename, POSIX mode, and file content; SSFileCopyReceiver, also running as UID 0 GID 80, creates the file with root ownership and the requested mode. In the researcher's proof, a policy file owned root:wheel with mode 0440 — "the mode matters: sudo accepts policy includes only when their ownership and permissions are safe" — was written to /private/etc/sudoers.d/99-screensharing-filecopy-proof, granting passwordless sudo. Phase 3: the attacker runs "sudo -n /bin/bash" and receives an interactive root shell. The researcher also wrote a callback script through the same file-copy channel to open Terminal and start it under the new sudo rule, demonstrating an automated, no-further-interaction path from file-copy abuse to a spawned root terminal — full remote root command execution requiring nothing beyond possession of the Screen Sharing VNC password. Discovery relied on differential-privilege reasoning rather than a crash: the identical file-copy operation ran as UID 502 and was denied under native Apple ID authentication, but ran as UID 0 and succeeded under legacy VNC authentication. The bug was found via Bynario's "Atlas" automated vulnerability-discovery workflow, which used GPT-5.5 for discovery and validation. Apple credits Pesoli, wdszzml, and the "Atuin" automated vulnerability discovery engine in its advisory.

Apple rated the issue 5.5; NVD/CISA-ADP independently scored it CVSS 3.1 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L), and cybersecuritynews.com's independent analysis argued for up to 8.8 on hosts with an active, unlocked session. It is fixed in macOS Tahoe 26.6 and macOS Sonoma 14.8.8, both released 2026-07-27; there is no evidence in CISA's Known Exploited Vulnerabilities catalog (checked as of the catalog's 2026-08-14 snapshot) that CVE-2026-43760 itself has been exploited in the wild. Exploitation strictly requires Screen Sharing/Remote Management to be enabled with the legacy "VNC viewers may control screen with password" option active, plus attacker knowledge of that VNC password — the initial-vector question of how an attacker obtains the password is not addressed in the public research and is not assumed here.

CVE-2026-43760 sits in the same Screen Sharing subsystem as a separate, more severe flaw, CVE-2026-65400 — a pre-authentication Secure Remote Password (SRP) implementation bug (a stale-success frame-length validator) that lets a remote attacker bypass authentication entirely, not merely abuse an already-authenticated VNC session. Apple emergency-patched CVE-2026-65400 on 2026-08-06 (macOS Tahoe 26.6.1, Sequoia 15.7.9, Sonoma 14.8.9); the Dutch NCSC reported on 2026-08-12 that it was being actively exploited in the wild against internet-exposed Macs (port 5900) to gain root and install Monero cryptocurrency miners, and CISA raised its score from 7.1 to 9.8 Critical on 2026-08-14. That in-the-wild exploitation and miner activity is attributed to CVE-2026-65400, not to CVE-2026-43760, and is documented here only as directly relevant subsystem/timeline context.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Lateral Movement

T1021.005 VNC

Execution

T1059.004 Unix Shell

Initial Access

T1133 External Remote Services

defense-impairment

T1222.002 Linux and Mac Permissions

Privilege Escalation

T1548.003 Sudo and Sudo Caching

privilege-escalation

T1548.003 Sudo and Sudo Caching; T1548.006 TCC Manipulation

Remediation for macOS Screen Sharing RCE

Patches

• Apply macOS Tahoe 26.6 (released 2026-07-27), which addresses CVE-2026-43760
• Apply macOS Sonoma 14.8.8 (released 2026-07-27), which addresses CVE-2026-43760
• Apply the 2026-08-06 emergency updates (macOS Tahoe 26.6.1 / Sequoia 15.7.9 / Sonoma 14.8.9), which additionally address the related pre-auth CVE-2026-65400

Immediate actions

• Disable "VNC viewers may control screen with password" under System Settings > General > Sharing > Screen Sharing options
• Disable Screen Sharing/Remote Management entirely on any Mac not actively using it, particularly internet-exposed hosts
• Restrict access to TCP/5900 (Screen Sharing/VNC) to trusted networks via firewall or VPN

Workarounds

• Disable legacy VNC password authentication for Screen Sharing
• Require native Apple ID authentication for any Remote Management session

Longer-term hardening

• Standardize on native Apple ID / Remote Management authentication and retire legacy VNC password screen sharing
• Monitor ES_EVENT_TYPE_NOTIFY_SCREENSHARING_ATTACH plus SSFileCopySender/SSFileCopyReceiver process execution via EDR for root-context (UID 0) activity following a VNC-authenticated session
• Audit /private/etc/sudoers.d/ for unauthorized or unexpected policy files

Affected and fixed versions

• Apple — macOS Sonoma
  Vulnerable versions: < 14.8.8
  Fixed in: 14.8.8
• Apple — macOS Tahoe
  Vulnerable versions: < 26.6
  Fixed in: 26.6

Timeline of macOS Screen Sharing RCE

• 2026-07-27 CVE-2026-43760 is published in NVD, credited to Alfredo Pesoli, wdszzml, and the Atuin Automated Vulnerability Discovery Engine.
• 2026-07-27 Apple releases macOS Tahoe 26.6 and macOS Sonoma 14.8.8, fixing CVE-2026-43760 with improved access restrictions on the Screen Sharing file-copy helpers.
• 2026-07-29 reverse.put.as publishes independent Screen Sharing exploitation research (including the locked-ioc-8 PoC tool), cited as an NVD reference for CVE-2026-43760.
• 2026-07-29 Alfredo Pesoli (Bynar.io/Bynario) publishes "A root remote command execution on macOS with M5 in 2026?", detailing the SSFileCopySender/SSFileCopyReceiver exploitation chain from protected-file read to sudoers.d write to interactive root shell.
• 2026-07-30 NVD/CISA-ADP last-modifies the CVE-2026-43760 record, publishing an independent CVSS 3.1 base score of 8.6, above Apple's own 5.5 rating.
• 2026-08-06 Apple emergency-releases macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9, patching a separate but related pre-authentication Screen Sharing SRP flaw, CVE-2026-65400.
• 2026-08-12 The Dutch National Cyber Security Centre reports active in-the-wild exploitation of CVE-2026-65400 against internet-exposed Macs, with attackers gaining root and installing Monero cryptocurrency miners.
• 2026-08-14 CISA raises CVE-2026-65400's CVSS score from 7.1 to 9.8 Critical following confirmed active exploitation; CVE-2026-43760 itself remains absent from the CISA KEV catalog as of this date.

Sources cited for macOS Screen Sharing RCE

• NVD - CVE-2026-43760 Detail NVD (NIST) · Advisory · 2026-07-27
• CISA Known Exploited Vulnerabilities Catalog CISA · Government advisory · 2026-08-14
• A root remote command execution on macOS with M5 in 2026? bynar.io · Research · 2026-07-29
• It's a pre-auth, stupid reverse.put.as · Research · 2026-07-29
• About the security content of macOS Tahoe 26.6 Apple · Vendor report · 2026-07-27
• About the security content of macOS Sonoma 14.8.8 Apple · Vendor report · 2026-07-27
• From Screen Share to Root Access: Breaking Down CVE-2026-43760 and CVE-2026-65400 on macOS Huntress · Research · 2026-08-06
• Supplementary Screen Sharing RCE exploitation writeup (navi_the_clown context) warez.sl0p.foo · Research · 2026-07-29
• Apple Screen Sharing Vulnerability (CVE-2026-43760) cybersecuritynews.com · News · 2026-08-17
• Apple macOS Screen Sharing Flaw Exploited on Internet-Exposed Macs to Install Monero Miner The Hacker News · News · 2026-08-13
• Critical macOS Screen Sharing Flaw Enables Pre-Auth RCE and Root File Access cyberpress.org · News · 2026-08-07
• Apple Patches Mac Screen Sharing Flaw That Could Bypass Authentication techrepublic.com · News · 2026-08-06
• Critical macOS Screen Sharing flaw gives attackers remote root access — CISA bumps bug to 9.8 severity following active Monero cryptojacking attacks tomshardware.com · News · 2026-08-14

Threats related to macOS Screen Sharing RCE

• CVE-2026-65400: macOS Screen Sharing Authentication Bypass Grants Unauthenticated Root Access
• Bad Epoll (CVE-2026-46242): Use-After-Free Zero-Day in Linux Kernel epoll Subsystem Enables Root Privilege Escalation
• Hackers Target Zimbra Servers in Active Exploitation Campaign via CVE-2026-73570 SNMP Command Injection
• CVE-2026-54420 — LiteSpeed cPanel Plugin Symlink-Following (CWE-61) Privilege Escalation to Root on CloudLinux/CageFS Shared Hosting; Added to CISA KEV After In-the-Wild Exploitation