Dutch cyber agency warns of live attacks on macOS Screen Sharing flaw

Key points

• The Netherlands' National Cyber Security Centre (NCSC) confirmed on its updated advisory that CVE-2026-65400 is being exploited in real attacks on Mac computers.
• Apple patched the flaw on 6 August in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9.
• The bug lets attackers skip the login step on macOS Screen Sharing, a built-in remote control feature that uses network port 5900.
• Every reported victim ended up with root access taken over and a Monero cryptocurrency miner installed.
• Public exploit code is already circulating, raising the risk for any Mac exposed directly to the internet.

The Dutch national cyber agency has updated its advisory to warn that a flaw in Apple's macOS is being used in live attacks, and that the pattern so far is depressingly familiar: break in, take over, mine crypto, move on.

The bug sits in Screen Sharing, the built-in Apple feature that lets you control one Mac from another over a network. It talks over TCP port 5900, the same port the old VNC (Virtual Network Computing) remote-desktop protocol has used for decades. If that port is open to the wider internet, this bug lets an attacker walk straight past the login prompt.

Apple fixed the flaw, tracked as CVE-2026-65400, on 6 August. The patched versions are macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9. Anything older than those, on a machine reachable from the internet with Screen Sharing turned on, is a sitting duck.

How are the attacks actually working?

Attackers scan the internet for Macs with port 5900 open, use the bug to skip authentication, and grab root, meaning full administrator control of the machine. From there they drop a miner for Monero, a privacy-focused cryptocurrency that is popular with criminals because the transactions are hard to trace.

In its updated notice, the NCSC said it had received a report that "active abuse of this vulnerability has been observed on multiple systems on which port 5900 was accessible from the Internet." In every reported case, root had been taken and a Monero miner planted.

The agency has not said how many machines are affected, when the campaign started, or whether the same intruders are doing anything beyond mining. Once you have root on someone else's computer, mining is the least interesting thing you can do with it. This is worth watching.

BleepingComputer first flagged that public exploit code had emerged before the wave of attacks, which tracks with the timeline: patch lands, proof-of-concept code appears, opportunists start spraying the internet.

What should Mac owners do right now?

Update. The three fixed builds are listed below, and Apple's own release notes describe the fix as improved state management to enforce correct credential validation. In plainer words, the system now actually checks who you are before letting you in.

If you cannot patch immediately, turn Screen Sharing off. Open System Settings, go to General, then Sharing, then Screen Sharing, and switch it off. If you do need it, keep it behind a VPN or your home router rather than exposing port 5900 to the open internet.

Home users are unlikely to have Screen Sharing pointed at the wider web on purpose. The higher risk sits with small businesses, creative studios, and IT admins who set up remote access for a specific job and left it running.

Is this really a macOS-specific problem?

Not really. An authentication bypass on a remote-access service, followed by a crypto miner, is one of the oldest patterns in the book. The same script has played out on exposed Redis instances, misconfigured Docker APIs, and RDP endpoints for years. What is new here is only the target and the CVE number. The lesson, as ever, is that anything listening on the public internet needs to be patched fast or firewalled off.