Apple September 2026 Security Updates: 273 CVEs incl. actively exploited Screen Sharing auth bypass (CVE-2026-65400) and critical Bluetooth RCE (CVE-2026-65414)

Key facts for Apple Screen Sharing bypass

Detection coverage for Apple Screen Sharing bypass

As of 2026-11-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5385 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CVE-2026-65400 macOS Screen Sharing Bypass — Root SSFileCopy Helper Launch

Detects launch of the Screen Sharing file-transfer helpers SSFileCopySender / SSFileCopyReceiver running as UID 0. After the CVE-2026-65400 screensharingd pre-auth bypass (TL-2026-5385), these helpers run as root with Full Disk Access and are used to read /etc/sudoers, SSH keys and keychains and to write files for code execution. Unexpected launches on a Mac are a high-fidelity exploitation indicator.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1005
• Data sources: osquery process_events (index=macos, sourcetype=osquery:results), Microsoft Defender for Endpoint DeviceProcessEvents (macOS), macOS Endpoint Security process events
• Severity: critical
• Confidence: high

Splunk SPL

index=macos sourcetype="osquery:results" name="*process_events*" earliest=-24h ("SSFileCopySender" OR "SSFileCopyReceiver")
```CVE-2026-65400 screensharingd auth bypass: Screen Sharing file-transfer helpers launched as root```
| eval proc_path='columns.path', cmdline='columns.cmdline', proc_uid='columns.uid'
| where match(proc_path, "/SSFileCopy(Sender|Receiver)$") AND proc_uid="0"
| stats count min(_time) as first_seen max(_time) as last_seen values(cmdline) as cmdlines by hostIdentifier, proc_path
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ('SSFileCopySender', 'SSFileCopyReceiver')
| where AccountName =~ 'root'
| project Timestamp, DeviceName, FileName, FolderPath, ProcessCommandLine, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

Sigma

title: macOS Screen Sharing SSFileCopy Helper Launched As Root (CVE-2026-65400)
id: a1c4e7f2-3b58-4d19-8e6a-52f0c9d17b01
status: experimental
description: Detects the Screen Sharing file-transfer helpers SSFileCopySender and SSFileCopyReceiver running as root, the post-authentication-bypass file read/write path of CVE-2026-65400 in screensharingd.
references:
  - https://www.resecurity.com/blog/article/cve-2026-65400-macos-screen-sharing-authentication-bypass-under-active-exploitation
  - https://www.tanium.com/blog/guardian-critical-macos-screen-sharing-authentication-bypass-cve-2026-65400
  - https://advisories.ncsc.nl/2026/ncsc-2026-0280.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
  - attack.initial_access
  - attack.t1190
  - attack.collection
  - attack.t1005
  - cve.2026-65400
logsource:
  category: process_creation
  product: macos
detection:
  selection_image:
    Image|endswith:
      - '/SSFileCopySender'
      - '/SSFileCopyReceiver'
  selection_user:
    User: 'root'
  condition: selection_image and selection_user
falsepositives:
  - Legitimate Screen Sharing file transfers by IT support staff or Apple Remote Desktop administrators
  - Authorized remote-support sessions from known management hosts
level: high

Known false positives:

• Legitimate Screen Sharing file transfers by IT support or ARD administrators
• Authorized remote-support sessions from known management hosts

Tuning notes: Baseline the Macs and admin sources that legitimately use Screen Sharing file transfer and suppress them by hostIdentifier. Correlate with inbound TCP/5900 from non-corporate addresses (SPL-003) and with ES_EVENT_TYPE_NOTIFY_SCREENSHARING_ATTACH events. Requires osquery process_events (or ES-based equivalent) enabled on macOS endpoints.

• 🔒 CVE-2026-65400 Post-Exploitation — Root Harvesting of sudoers, master.passwd, SSH Keys and Keychains · unlock with TL Creds
• 🔒 CVE-2026-65400 Post-Exploitation — macOS Log Clearing and Packet-Filter Tampering · unlock with TL Creds
• 🔒 CVE-2026-65400 Impact — XMRig 6.26.0 Miner Masquerading as [indicator] / [indicator] · unlock with TL Creds
• 🔒 CVE-2026-65400 Miner Staging — xmrig Files in /tmp, ~/Downloads and Hidden [indicator] · unlock with TL Creds
• 🔒 CVE-2026-65400 Root launchctl Load Of Non-Apple LaunchDaemon (PoC RCE and Persistence) · unlock with TL Creds
• 🔒 CVE-2026-65400 Public PoC Tooling Execution On macOS Endpoints · unlock with TL Creds
• 🔒 CVE-2026-65400 Post-Exploitation — Root authorized_keys and LaunchDaemon Persistence · unlock with TL Creds
• 🔒 CVE-2026-65400 Exposure — Allowed Inbound TCP/5900 From Public Sources · unlock with TL Creds

Indicators of compromise for Apple Screen Sharing bypass

As of 2026-11-06, Threadlinqs Intelligence tracks 11 indicators of compromise for TL-2026-5385.

How Apple Screen Sharing bypass works

CVE-2026-65414 is a CVSS 9.8 network-reachable Bluetooth out-of-bounds write affecting all eight Apple platforms, with no exploitation reported at publication.

ZDI's September 2026 Apple Security Update Review (Dustin Childs, 2026-09-16) covers 273 CVEs published 2026-09-14 for macOS 27 (Golden Gate), macOS Sequoia 15.8, macOS Tahoe 26.7, iOS/iPadOS 27 (and 26.7), visionOS 27, watchOS 27, tvOS 27, Safari 27 and Xcode 27. The severity breakdown given by ZDI is 2 critical, 46 high, 84 medium, 2 low and 139 not yet scored.

CVE-2026-65400 (Screen Sharing Server, CVSS 9.8 after CISA rescored it from 7.1 on 2026-08-14) is an authentication state-management flaw in screensharingd, which listens on TCP/5900 and speaks an Apple RFB/VNC variant with SRP authentication. Per Resecurity, malformed SRP frames cause a validation failure that is not propagated, so the state machine desynchronizes and returns an authenticated state without credential verification. The resulting session reaches the Screen Sharing file-transfer helpers (SSFileCopySender/SSFileCopyReceiver), which run as UID/GID 0 with Full Disk Access (kTCCServiceSystemPolicyAllFiles). An attacker can therefore read protected files such as /etc/sudoers, /etc/master.passwd, SSH keys and keychains, and write files for remote code execution. SIP still restricts protected system locations. Apple first patched the flaw on 2026-08-06 in macOS Tahoe 26.6.1, Sequoia 15.7.9 and Sonoma 14.8.9. ZDI lists it again for macOS 27 and Tahoe 26.7. Public PoCs exist, and NCSC-NL reports abuse of Macs with TCP/5900 exposed to the internet, ending in root access and Monero mining. Microsoft Security Intelligence, as summarized by Tanium, saw attackers install SSH public keys and a LaunchDaemon, clear logs, modify packet-filter settings and deploy XMRig 6.26.0 as a .config/sysmond binary masquerading as com.apple.airportd. CISA added the CVE to KEV on 2026-08-18 with a federal due date of 2026-08-21. Resecurity also reports that research indicates at least two independent pre-auth bugs in this codebase.

CVE-2026-65414 (Bluetooth, CWE-787 out-of-bounds write, CVSS 9.8, vector AV:N/AC:L/PR:N/UI:N) lets a remote attacker cause app termination or arbitrary code execution. It affects all eight OS platforms and is fixed in iOS/iPadOS 26.7 and 27, macOS Golden Gate 27, Sequoia 15.8 and Tahoe 26.7, tvOS 27, visionOS 27 and watchOS 27 (Apple advisory 149036). CISA's SSVC tags it automatable: yes, technical impact: total. Public sources reported no PoC or active exploitation at publication, and ZDI flags it as a likely future KEV candidate. Other notable fixes: CVE-2026-65346 (ImageIO, CVSS 8.8, malicious-image code execution, reachable through Messages and previews), CVE-2026-43692 (CUPS, CVSS 8.8, RCE), CVE-2026-84607 (AVEVideoEncoder, sandbox-to-kernel code execution, unscored) and CVE-2026-43790 (Kernel, remote kernel memory corruption, unscored). The ZDI article states no IOCs, actor attribution or PoC for these. The exploitation-specific details above come from secondary sources and were not in the ZDI article.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1564.001 Hidden Files and Directories

Persistence

T1098.004 SSH Authorized Keys; T1543.004 Launch Daemon

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1496.001 Compute Hijacking

Credential Access

T1552.004 Private Keys; T1555.001 Keychain

Reconnaissance

T1595.001 Scanning IP Blocks

defense-impairment

T1685.006 Clear Linux or Mac System Logs; T1686 Disable or Modify System Firewall

Remediation for Apple Screen Sharing bypass

Patches

• CVE-2026-65400: macOS Tahoe 26.6.1, Sequoia 15.7.9, Sonoma 14.8.9 (2026-08-06); also listed for macOS 27 and Tahoe 26.7
• CVE-2026-65414: iOS/iPadOS 26.7 and 27, macOS 27, Sequoia 15.8, Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27 (Apple advisory 149036)

Immediate actions

• Apply the September 2026 Apple updates: macOS 27, Tahoe 26.7, Sequoia 15.8, iOS/iPadOS 26.7/27, visionOS 27, watchOS 27, tvOS 27, Safari 27, Xcode 27
• Block inbound TCP/5900 from the internet and untrusted networks
• Disable Screen Sharing (System Settings > General > Sharing) on Macs that do not need it
• Audit /var/root/.ssh/authorized_keys, /Library/LaunchDaemons and /etc/pf.conf on any Mac that exposed TCP/5900

Workarounds

• Turn off Screen Sharing and restrict TCP/5900 at the host and perimeter firewall
• Use Zeek or Suricata detection for malformed SRP frames (initconf/zeek-screensharing-rce)
• Disable Bluetooth on unpatched devices where operationally feasible

Longer-term hardening

• Put remote access to Macs behind a VPN or jump host instead of direct internet exposure
• Enforce OS updates through MDM and keep an inventory of internet-facing services
• Collect Screen Sharing telemetry, such as the Endpoint Security screensharing attach event, and monitor inbound TCP/5900
• Segment Macs holding signing identities, SSH keys or cloud credentials from general networks

Affected and fixed versions

• Apple — macOS (Screen Sharing / screensharingd)
  Vulnerable versions: Tahoe < 26.6.1; Sequoia < 15.7.9; Sonoma < 14.8.9
  Fixed in: Tahoe 26.6.1; Sequoia 15.7.9; Sonoma 14.8.9; Tahoe 26.7; macOS 27
• Apple — macOS, iOS, iPadOS, tvOS, visionOS, watchOS (Bluetooth, CVE-2026-65414)
  Vulnerable versions: versions prior to the September 2026 releases
  Fixed in: iOS/iPadOS 26.7 and 27; macOS Golden Gate 27, Sequoia 15.8, Tahoe 26.7; tvOS 27; visionOS 27; watchOS 27
• Apple — macOS, tvOS, watchOS, visionOS (ImageIO, CVE-2026-65346)
  Vulnerable versions: versions prior to the September 2026 releases
  Fixed in: macOS Sequoia 15.8; tvOS 27; watchOS 27; visionOS 27
• Apple — macOS (CUPS, CVE-2026-43692)
  Vulnerable versions: versions prior to the September 2026 releases
  Fixed in: macOS 27; Tahoe 26.7; Sequoia 15.8

Timeline of Apple Screen Sharing bypass

• 2026-07-27 Apple silently patches a first pre-auth Screen Sharing bug in macOS 26.6 without a CVE (per Resecurity).
• 2026-07-29 fG! publishes 'It's a pre-auth, stupid!' with a read-only PoC for the Screen Sharing flaw.
• 2026-08-06 Apple releases fixes for CVE-2026-65400 in macOS Tahoe 26.6.1, Sequoia 15.7.9 and Sonoma 14.8.9.
• 2026-08-07 NCSC-NL publishes advisory NCSC-2026-0280 for CVE-2026-65400 (CVSS 7.1).
• 2026-08-12 NCSC-NL updates its advisory (v1.0.1): public PoC available and active abuse known, with root access and Monero miners on Macs exposing TCP/5900.
• 2026-08-14 CISA rescores CVE-2026-65400 from 7.1 to 9.8 Critical.
• 2026-08-18 CISA adds CVE-2026-65400 to the Known Exploited Vulnerabilities catalog.
• 2026-08-21 Federal remediation deadline for CVE-2026-65400 under the KEV entry.
• 2026-09-14 Apple publishes 273 CVEs across macOS 27, Tahoe 26.7, Sequoia 15.8, iOS/iPadOS 27, visionOS, watchOS, tvOS, Safari and Xcode, including CVE-2026-65414.
• 2026-09-16 ZDI publishes its September 2026 Apple Security Update Review, flagging CVE-2026-65400 as actively exploited and CVE-2026-65414 as a likely KEV candidate.

Sources cited for Apple Screen Sharing bypass

• NCSC-NL Advisory NCSC-2026-0280 advisories.ncsc.nl · Advisory · 2026-08-07
• CISA Adds Four Known Exploited Vulnerabilities to Catalog CISA · Government advisory · 2026-08-18
• CVE-2026-65400 CVE Record CVE Program · Advisory
• CVE-2026-65400 macOS Screen Sharing Authentication Bypass Under Active Exploitation (Resecurity) resecurity.com · Research
• Critical macOS Screen Sharing Authentication Bypass CVE-2026-65400 (Tanium) tanium.com · Vendor report
• It's a pre-auth, stupid! (fG!) reverse.put.as · Research · 2026-07-29
• CTIPilot: CVE-2026-65400 screensharingd remote root ctipilot.ch · Research · 2026-08-11
• Apple Security Content 148170 (macOS Screen Sharing fix) Apple · Vendor report · 2026-08-06
• Apple Security Content 149036 (CVE-2026-65414) Apple · Vendor report · 2026-09-14
• The Apple Security Update Review for September 2026 (ZDI) thezdi.com · Blog · 2026-09-16
• CVE-2026-65414 analysis (Feedly) feedly.com · News · 2026-09-14

More in vulnerability

• Metasploit 6.5.9 Wrapup: Public Exploit Modules for Citrix NetScaler (CVE-2026-88771), Cisco Secure Email Gateway (CVE-2026-76461/76443), GitLab CI/CD Regex RCE (CVE-2026-97229), OpenBullet2, Flowise, SPIP and WordPress Bug Library
• CVE-2026-113618: Improper Certificate Validation in KAMSOFT ZSIRep CLIENT library
• D-Link DGS-3130 Series Switches: Multiple Unpatched Zero-Days in D-Link Discovery Protocol (DDP) and Firmware (D-Link SAP10523, CVEs Pending)
• Multiple Vulnerabilities in Microsoft Edge (prior to 157.0.4341.42) - 27 Chromium CVEs - HK GovCERT A26-11-10
• OpenAI GPT-6 Cyber Identifies 81 Previously Unknown High-Severity Firefox Vulnerabilities (Mozilla MFSA2026-118, Firefox 159)