[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fonJoHfkga7AQ8-7l2QH-IPC78uGJpj1IdBwKebQtOCE":3,"$flLScryNos6s00ELcvlx64yZmV9pXaGwfgdHii9dALP8":40},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":36,"created_at":37,"updated_at":38,"published_at":39},"attackers-exploit-macos-screen-sharing-authentication-bypass-cve-2026-65400-to-g","Attackers Exploit macOS Screen Sharing Authentication Bypass CVE-2026-65400 to Gain Root and Deploy Monero Miners","Dutch NCSC flags active in-the-wild exploitation after public exploit code appears.","The flaw in macOS Screen Sharing allows network-based attackers to bypass authentication and obtain root access, with observed deployments of Monero crypto miners on compromised systems.",[10,11,12,13,14],"macOS","Screen Sharing","CVE-2026-65400","Authentication Bypass","Monero Miner","# Attackers Exploit macOS Screen Sharing Authentication Bypass CVE-2026-65400 to Gain Root and Deploy Monero Miners\n\n*Dutch NCSC flags active in-the-wild exploitation after public exploit code appears.*\n\n**Tags:** `macOS` `Screen Sharing` `CVE-2026-65400` `Authentication Bypass` `Monero Miner`\n\n> The flaw in macOS Screen Sharing allows network-based attackers to bypass authentication and obtain root access, with observed deployments of Monero crypto miners on compromised systems.\n\n---\n\n## What happened\n\nApple patched CVE-2026-65400 on 6 August in macOS Tahoe 26.6.1 and earlier releases after network-based exploitation of the flaw was observed in the wild. The vulnerability resides in macOS Screen Sharing, the built-in remote desktop feature that exposes VNC over TCP port 5900. The defect allows an unauthenticated remote attacker to gain access without valid credentials and to open applications remotely and access files on the affected system.\n\nPublic exploit code for the issue emerged alongside reports of active abuse. In the observed incidents root had been accessed on the affected systems and a Monero cryptocurrency miner had been placed.\n\nApple addressed CVE-2026-65400 with releases that improve state management mechanisms to enforce correct credential validation and prevent rogue authentication attempts. The fix is included in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9.\n\n## Technical details\n\nCVE-2026-65400 is a flaw in the macOS Screen Sharing service that handles incoming VNC connections on TCP port 5900. The defect is in the service’s state management for authentication, which allows the credential validation sequence to be reached in an unexpected state during a network session.\n\nUnder the vulnerable conditions an unauthenticated remote actor can complete the VNC handshake without presenting valid credentials and obtain an interactive session on the target. Once the session is established the attacker can launch applications remotely and read files accessible to the service process, with observed post-compromise activity reaching root-level access on affected hosts.\n\nExploitation is network-based and does not require user interaction. Public exploit code appeared in parallel with in-the-wild reports, and the observed intrusions involved placement of a Monero cryptocurrency miner after privilege escalation.\n\n## Who is affected\n\nCVE-2026-65400 affects macOS systems with the built-in Screen Sharing service enabled and reachable over the network. The vulnerable configurations are macOS Tahoe 26.6 and earlier, macOS Sequoia 15.7.8 and earlier, and macOS Sonoma 14.8.8 and earlier. Any host that exposes VNC on TCP port 5900 without the August 6 updates is in scope for unauthenticated remote access.\n\nIn-the-wild abuse has been observed against internet-exposed Macs where Screen Sharing is active. The observed post-compromise activity includes root-level access on affected hosts and deployment of a Monero cryptocurrency miner. The exposure puts interactive desktop sessions, locally accessible files and privileged system operations at risk for users and organizations that rely on macOS endpoints.\n\n## What to do\n\nDefenders should update affected macOS endpoints immediately to the patched releases issued on 6 August. Apple has shipped the fix in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9. Systems that cannot be updated right away should have Screen Sharing disabled where it is not required for business use, and inbound access to TCP port 5900 should be blocked at the perimeter firewall or host-based firewall for any Mac that does not need remote desktop.\n\nNetwork teams should treat internet-exposed VNC on port 5900 as high risk until patched and review perimeter logs for unsolicited connection attempts to that port from external addresses. Endpoint monitoring should look for unexpected launches of remote desktop sessions, privilege escalation events, and the creation or execution of mining-related processes and binaries commonly associated with Monero miners observed in post-compromise activity.\n\nApple recommends upgrading to one of the fixed releases to restore correct credential validation in the Screen Sharing service. Organizations with managed fleets should verify patch compliance for macOS Tahoe 26.6 and earlier, macOS Sequoia 15.7.8 and earlier, and macOS Sonoma 14.8.8 and earlier, and re-enable Screen Sharing only after the update is confirmed.\n\n## Key points\n\n- Active exploitation of CVE-2026-65400 in macOS Screen Sharing is underway following public release of exploit code.\n- The vulnerability allows network-based attackers to gain access without valid credentials via VNC on TCP port 5900.\n- Compromised systems show root access obtained and a Monero crypto miner placed on the affected host.\n- Apple fixed the flaw on August 6 in macOS Tahoe 26.6.1 and earlier releases, improving state management to enforce correct credential validation.\n- Patched releases include macOS Tahoe 26.6.1, macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9.\n\n## Further reading & sources\n\n- [Hackers exploit macOS Screen Sharing flaw to deploy Monero miner](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-exploit-macos-screen-sharing-flaw-to-deploy-monero-miner) — BleepingComputer","https:\u002F\u002Fllqtyrforgvojyokyvkk.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fattackers-exploit-macos-screen-sharing-authentication-bypass-cve-2026-65400-to-g.png",{"malware":18,"timeline":21,"technologies":30},[19],{"name":20},"Monero cryptocurrency miner",[22,26],{"date":23,"event":24,"description":25},"2026-08-06","patch","Apple fixed CVE-2026-65400 in macOS releases",{"date":27,"event":28,"description":29},"2026-08-14","disclosure","NCSC warns of active exploitation of macOS Screen Sharing flaw",[31,34],{"vendor":32,"product":33},"Apple","macOS Tahoe",{"vendor":32,"product":35},"macOS Screen Sharing","exploitation","2026-08-18T14:41:55.953675+00:00","2026-08-18T18:36:23.673782+00:00",null,{"articles":41},[42,53,64,77],{"slug":43,"title":44,"summary":45,"tags":46,"hero_image_url":51,"story_type":36,"created_at":52},"attackers-exploit-sharepoint-authentication-bypass-cve-2026-55040-following-publ","Attackers Exploit SharePoint Authentication Bypass CVE-2026-55040 Following Public PoC Release","Microsoft SharePoint is under active attack as threat actors exploit CVE-2026-55040, a critical security feature bypass with a CVSS score of 9.1, immediately after public proof-of-concept code became available.",[47,48,13,49,50],"SharePoint","CVE-2026-55040","Active Exploitation","Microsoft Security","https:\u002F\u002Fllqtyrforgvojyokyvkk.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fattackers-exploit-sharepoint-authentication-bypass-cve-2026-55040-following-publ.png","2026-08-18T18:47:03.864693+00:00",{"slug":54,"title":55,"summary":56,"tags":57,"hero_image_url":62,"story_type":36,"created_at":63},"active-attacks-target-max-severity-sap-commerce-cloud-rce-patched-three-days-ago","Active Attacks Target Max-Severity SAP Commerce Cloud RCE Patched Three Days Ago","A critical remote code execution vulnerability in SAP Commerce Cloud, patched on Tuesday, is already seeing exploitation attempts in the wild just three days later, according to Defused. The flaw, tracked as CVE-2026-58231, allows unauthenticated attackers to abuse a default authentication client and submit crafted input to trigger arbitrary code execution with high impact on confidentiality, integrity and availability.",[58,59,60,61],"SAP","Commerce Cloud","RCE","Retail","https:\u002F\u002Fllqtyrforgvojyokyvkk.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Factive-attacks-target-max-severity-sap-commerce-cloud-rce-patched-three-days-ago.png","2026-08-14T15:55:48.267776+00:00",{"slug":65,"title":66,"summary":67,"tags":68,"hero_image_url":74,"story_type":75,"created_at":76},"new-ransomware-group-linkc-targets-h2o-ai-with-extortion-claims","New Ransomware Group Linkc Targets H2O.ai with Extortion Claims","A newly identified ransomware operation named Linkc has emerged, claiming to have breached AI and cloud provider H2O.ai and demanding payment in exchange for withheld sensitive corporate information.",[69,70,71,72,73],"Ransomware","H2O.ai","Data Exfiltration","Cybersecurity Threats","Extortion","https:\u002F\u002Fllqtyrforgvojyokyvkk.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fnew-ransomware-group-linkc-targets-h2o-ai-with-extortion-claims.png","threat_actor_activity","2026-08-18T18:41:58.855449+00:00",{"slug":78,"title":79,"summary":80,"tags":81,"hero_image_url":86,"story_type":87,"created_at":88},"hunters-international-ceases-operations-announces-mass-leak-of-stolen-data-from-","Hunters International Ceases Operations, Announces Mass Leak of Stolen Data from 67 Victims","Hunters International has officially closed its project and announced it will leak stolen data from 67 victims, following a period of increased law enforcement pressure that led to its rebranding as World Leaks earlier this year.",[69,82,83,84,85],"Data Extortion","Hunters International","World Leaks","Cybercrime","https:\u002F\u002Fllqtyrforgvojyokyvkk.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fhunters-international-ceases-operations-announces-mass-leak-of-stolen-data-from-.png","ransomware_incident","2026-08-18T18:39:28.135907+00:00"]