Act nowKnown exploited

Advisory · CVE-2026-65400

Attackers are exploiting a critical macOS Screen Sharing authentication bypass

A critical state-management flaw can let a network attacker authenticate to macOS Screen Sharing without valid credentials.

Advisory published August 18, 2026Independent summary
Vendor
Apple
Product
macOS
Identifier / CWE
CVE-2026-65400
CWE-287
Action timing
Aug 21, 2026
ELI5

Explain it like I’m five

Screen Sharing can lose track of whether a visitor actually proved who they are. A nearby or reachable attacker may get a remote session without supplying valid credentials.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Screen Sharing reachable

    An attacker on a network path connects to a Mac with Screen Sharing exposed.

  2. 02State confused

    A flaw in authentication state handling breaks the expected credential check.

  3. 03Login accepted

    The attacker authenticates to Screen Sharing without valid credentials.

  4. 04Remote access

    The exposed Mac and data available to the session can be accessed remotely.

What happened

CISA added CVE-2026-65400 to the Known Exploited Vulnerabilities catalog on August 18, 2026. The vulnerability can allow an attacker on the network to authenticate to macOS Screen Sharing without valid credentials. Apple says it corrected the issue through improved state management.

The fixed releases are macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9. NVD records a critical CVSS 3.1 score of 9.8 from a secondary source.

What to do

  1. Identify Macs with Screen Sharing or Remote Management enabled, especially systems reachable from untrusted networks.
  2. Update affected systems to the fixed release for their supported macOS branch.
  3. Disable Screen Sharing where it is not required and restrict necessary access to trusted management networks.
  4. Review remote-access, unified, identity, endpoint, and network logs for unexpected Screen Sharing connections.
  5. Investigate unfamiliar accounts, persistence, processes, configuration changes, and outbound connections on exposed Macs.
  6. Revoke sessions and rotate credentials accessible to affected user contexts if compromise cannot be excluded.
  7. Verify the running macOS build and the resulting sharing configuration after remediation.

Management note

Remote-access authentication bypass with confirmed exploitation deserves immediate endpoint action. Prioritize Macs used by administrators, developers, and other users whose sessions hold privileged credentials or production access.