# Apple September 2026 Security Updates: 273 CVEs incl. actively exploited Screen Sharing auth bypass (CVE-2026-65400) and critical Bluetooth RCE (CVE-2026-65414)

> Apple's 14 September 2026 updates fix 273 CVEs across macOS, iOS/iPadOS, visionOS, watchOS, tvOS, Safari and Xcode. CVE-2026-65400, a pre-authentication bypass in the macOS Screen Sharing daemon (screensharingd, TCP/5900), is in the CISA KEV catalog and has been exploited to gain root and deploy the XMRig Monero miner. CVE-2026-65414 is a CVSS 9.8 network-reachable Bluetooth out-of-bounds write affecting all eight Apple platforms, with no exploitation reported at publication.

- **Published:** 2026-11-06T06:55:33Z
- **Last reviewed:** 2026-11-06T06:55:33Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5385
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5385.png
- **ID:** TL-2026-5385
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 11
- **CVEs:** CVE-2026-65400, CVE-2026-65414, CVE-2026-65346, CVE-2026-43692, CVE-2026-84607, CVE-2026-43790

## Description

ZDI's September 2026 Apple Security Update Review (Dustin Childs, 2026-09-16) covers 273 CVEs published 2026-09-14 for macOS 27 (Golden Gate), macOS Sequoia 15.8, macOS Tahoe 26.7, iOS/iPadOS 27 (and 26.7), visionOS 27, watchOS 27, tvOS 27, Safari 27 and Xcode 27. The severity breakdown given by ZDI is 2 critical, 46 high, 84 medium, 2 low and 139 not yet scored.

CVE-2026-65400 (Screen Sharing Server, CVSS 9.8 after CISA rescored it from 7.1 on 2026-08-14) is an authentication state-management flaw in screensharingd, which listens on TCP/5900 and speaks an Apple RFB/VNC variant with SRP authentication. Per Resecurity, malformed SRP frames cause a validation failure that is not propagated, so the state machine desynchronizes and returns an authenticated state without credential verification. The resulting session reaches the Screen Sharing file-transfer helpers (SSFileCopySender/SSFileCopyReceiver), which run as UID/GID 0 with Full Disk Access (kTCCServiceSystemPolicyAllFiles). An attacker can therefore read protected files such as /etc/sudoers, /etc/master.passwd, SSH keys and keychains, and write files for remote code execution. SIP still restricts protected system locations. Apple first patched the flaw on 2026-08-06 in macOS Tahoe 26.6.1, Sequoia 15.7.9 and Sonoma 14.8.9. ZDI lists it again for macOS 27 and Tahoe 26.7. Public PoCs exist, and NCSC-NL reports abuse of Macs with TCP/5900 exposed to the internet, ending in root access and Monero mining. Microsoft Security Intelligence, as summarized by Tanium, saw attackers install SSH public keys and a LaunchDaemon, clear logs, modify packet-filter settings and deploy XMRig 6.26.0 as a .config/sysmond binary masquerading as com.apple.airportd. CISA added the CVE to KEV on 2026-08-18 with a federal due date of 2026-08-21. Resecurity also reports that research indicates at least two independent pre-auth bugs in this codebase.

CVE-2026-65414 (Bluetooth, CWE-787 out-of-bounds write, CVSS 9.8, vector AV:N/AC:L/PR:N/UI:N) lets a remote attacker cause app termination or arbitrary code execution. It affects all eight OS platforms and is fixed in iOS/iPadOS 26.7 and 27, macOS Golden Gate 27, Sequoia 15.8 and Tahoe 26.7, tvOS 27, visionOS 27 and watchOS 27 (Apple advisory 149036). CISA's SSVC tags it automatable: yes, technical impact: total. Public sources reported no PoC or active exploitation at publication, and ZDI flags it as a likely future KEV candidate. Other notable fixes: CVE-2026-65346 (ImageIO, CVSS 8.8, malicious-image code execution, reachable through Messages and previews), CVE-2026-43692 (CUPS, CVSS 8.8, RCE), CVE-2026-84607 (AVEVideoEncoder, sandbox-to-kernel code execution, unscored) and CVE-2026-43790 (Kernel, remote kernel memory corruption, unscored). The ZDI article states no IOCs, actor attribution or PoC for these. The exploitation-specific details above come from secondary sources and were not in the ZDI article.

## MITRE ATT&CK

- T1595.001 Scanning IP Blocks
- T1190 Exploit Public-Facing Application
- T1098.004 SSH Authorized Keys
- T1543.004 Launch Daemon
- T1685.006 Clear Linux or Mac System Logs
- T1686 Disable or Modify System Firewall
- T1036.005 Match Legitimate Resource Name or Location
- T1564.001 Hidden Files and Directories
- T1552.004 Private Keys
- T1555.001 Keychain
- T1005 Data from Local System
- T1496.001 Compute Hijacking

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CVE-2026-65400 macOS Screen Sharing Bypass — Root SSFileCopy Helper Launch** (`TL-2026-5385-SPL-001`)

Detects launch of the Screen Sharing file-transfer helpers SSFileCopySender / SSFileCopyReceiver running as UID 0. After the CVE-2026-65400 screensharingd pre-auth bypass (TL-2026-5385), these helpers run as root with Full Disk Access and are used to read /etc/sudoers, SSH keys and keychains and to write files for code execution. Unexpected launches on a Mac are a high-fidelity exploitation indicator.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1005
- **Data sources:** osquery process_events (index=macos, sourcetype=osquery:results), Microsoft Defender for Endpoint DeviceProcessEvents (macOS), macOS Endpoint Security process events
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

````spl
index=macos sourcetype="osquery:results" name="*process_events*" earliest=-24h ("SSFileCopySender" OR "SSFileCopyReceiver")
```CVE-2026-65400 screensharingd auth bypass: Screen Sharing file-transfer helpers launched as root```
| eval proc_path='columns.path', cmdline='columns.cmdline', proc_uid='columns.uid'
| where match(proc_path, "/SSFileCopy(Sender|Receiver)$") AND proc_uid="0"
| stats count min(_time) as first_seen max(_time) as last_seen values(cmdline) as cmdlines by hostIdentifier, proc_path
| convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ('SSFileCopySender', 'SSFileCopyReceiver')
| where AccountName =~ 'root'
| project Timestamp, DeviceName, FileName, FolderPath, ProcessCommandLine, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc
```

### Sigma

```yaml
title: macOS Screen Sharing SSFileCopy Helper Launched As Root (CVE-2026-65400)
id: a1c4e7f2-3b58-4d19-8e6a-52f0c9d17b01
status: experimental
description: Detects the Screen Sharing file-transfer helpers SSFileCopySender and SSFileCopyReceiver running as root, the post-authentication-bypass file read/write path of CVE-2026-65400 in screensharingd.
references:
  - https://www.resecurity.com/blog/article/cve-2026-65400-macos-screen-sharing-authentication-bypass-under-active-exploitation
  - https://www.tanium.com/blog/guardian-critical-macos-screen-sharing-authentication-bypass-cve-2026-65400
  - https://advisories.ncsc.nl/2026/ncsc-2026-0280.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
  - attack.initial_access
  - attack.t1190
  - attack.collection
  - attack.t1005
  - cve.2026-65400
logsource:
  category: process_creation
  product: macos
detection:
  selection_image:
    Image|endswith:
      - '/SSFileCopySender'
      - '/SSFileCopyReceiver'
  selection_user:
    User: 'root'
  condition: selection_image and selection_user
falsepositives:
  - Legitimate Screen Sharing file transfers by IT support staff or Apple Remote Desktop administrators
  - Authorized remote-support sessions from known management hosts
level: high
```

**Known false positives:**

- Legitimate Screen Sharing file transfers by IT support or ARD administrators
- Authorized remote-support sessions from known management hosts

**Tuning notes:** Baseline the Macs and admin sources that legitimately use Screen Sharing file transfer and suppress them by hostIdentifier. Correlate with inbound TCP/5900 from non-corporate addresses (SPL-003) and with ES_EVENT_TYPE_NOTIFY_SCREENSHARING_ATTACH events. Requires osquery process_events (or ES-based equivalent) enabled on macOS endpoints.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CVE-2026-65400 Post-Exploitation — Root Harvesting of sudoers, master.passwd, SSH Keys and Keychains (locked: unlock with TL Creds)
- CVE-2026-65400 Post-Exploitation — macOS Log Clearing and Packet-Filter Tampering (locked: unlock with TL Creds)
- CVE-2026-65400 Impact — XMRig 6.26.0 Miner Masquerading as [indicator] / [indicator] (locked: unlock with TL Creds)
- CVE-2026-65400 Miner Staging — xmrig Files in /tmp, ~/Downloads and Hidden [indicator] (locked: unlock with TL Creds)
- CVE-2026-65400 Root launchctl Load Of Non-Apple LaunchDaemon (PoC RCE and Persistence) (locked: unlock with TL Creds)
- CVE-2026-65400 Public PoC Tooling Execution On macOS Endpoints (locked: unlock with TL Creds)
- CVE-2026-65400 Post-Exploitation — Root authorized_keys and LaunchDaemon Persistence (locked: unlock with TL Creds)
- CVE-2026-65400 Exposure — Allowed Inbound TCP/5900 From Public Sources (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [The Apple Security Update Review for September 2026 (ZDI)](https://www.thezdi.com/blog/2026/9/16/the-apple-security-update-review-for-september-2026)
- [CVE-2026-65400 macOS Screen Sharing Authentication Bypass Under Active Exploitation (Resecurity)](https://www.resecurity.com/blog/article/cve-2026-65400-macos-screen-sharing-authentication-bypass-under-active-exploitation)
- [Critical macOS Screen Sharing Authentication Bypass CVE-2026-65400 (Tanium)](https://www.tanium.com/blog/guardian-critical-macos-screen-sharing-authentication-bypass-cve-2026-65400)
- [NCSC-NL Advisory NCSC-2026-0280](https://advisories.ncsc.nl/2026/ncsc-2026-0280.html)
- [CISA Adds Four Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/08/18/cisa-adds-four-known-exploited-vulnerabilities-catalog)
- [CVE-2026-65400 CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-65400)
- [It's a pre-auth, stupid! (fG!)](https://reverse.put.as/2026/07/29/its-a-pre-auth-stupid/)
- [CTIPilot: CVE-2026-65400 screensharingd remote root](https://ctipilot.ch/entries/2026-08-11/cve-2026-65400-screensharingd-remote-root-two-preauth-bugs/)
- [Apple Security Content 148170 (macOS Screen Sharing fix)](https://support.apple.com/en-us/148170)
- [Apple Security Content 149036 (CVE-2026-65414)](https://support.apple.com/en-us/149036)
- [CVE-2026-65414 analysis (Feedly)](https://feedly.com/cve/CVE-2026-65414)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5385