Dutch cyber agency warns of live attacks on macOS Screen Sharing flaw

Key points

• The Netherlands' National Cyber Security Centre (NCSC) confirmed in its updated advisory that CVE-2026-65400 is being exploited in real attacks on Mac computers.
• Apple patched the flaw on 6 August in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9.
• The bug lets attackers skip the login step on macOS Screen Sharing, a built-in remote control feature that uses network port 5900.
• Every reported victim ended up with root access taken over and a Monero cryptocurrency miner installed.
• Public exploit code is already circulating, raising the risk for any Mac exposed directly to the internet.

The Dutch national cyber agency has updated its advisory to warn that a flaw in Apple's macOS is being used in live attacks. The pattern so far is depressingly familiar: break in, take over, mine crypto, move on.

Screen Sharing is Apple's built-in feature for controlling one Mac from another over a network. It runs over TCP port 5900, the same port the VNC (Virtual Network Computing) remote-desktop protocol has used for decades. If that port is open to the wider internet, this bug lets an attacker walk straight past the login prompt. When we covered the patch on 7 August, Apple quietly fixed a flaw that lets someone access your screen without logging in; now we know it's being actively abused.

Apple fixed the flaw, tracked as CVE-2026-65400, on 6 August. The patched versions are macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9. Anything older than those, on a machine reachable from the internet with Screen Sharing turned on, is a sitting duck.

How are the attacks actually working?

Attackers scan the internet for Macs with port 5900 open, use the bug to skip authentication, and grab root, meaning full administrator control of the machine. From there they drop a miner for Monero, a privacy-focused cryptocurrency popular with criminals because its transactions are hard to trace.

In its updated notice, the NCSC said it had received a report that "active abuse of this vulnerability has been observed on multiple systems on which port 5900 was accessible from the Internet." In every reported case, root had been taken and a Monero miner planted.

The agency hasn't said how many machines are affected, when the campaign started, or whether the same intruders are doing anything beyond mining. Once you've got root on someone else's computer, mining is the least interesting thing you can do with it. That's what makes this worth watching.

BleepingComputer first flagged that public exploit code had emerged before the wave of attacks, which tracks with the timeline: patch lands, proof-of-concept code appears, opportunists start spraying the internet.

What should Mac owners do right now?

Update. The three fixed builds are listed below. Apple's release notes describe the fix as improved state management to enforce correct credential validation: the system now actually checks who you are before letting you in.

If you can't patch immediately, turn Screen Sharing off. Open System Settings, go to General, then Sharing. Find Screen Sharing and switch it off. If you do need it, keep it behind a VPN or your home router rather than exposing port 5900 to the open internet.

Home users are unlikely to have Screen Sharing pointed at the wider web on purpose. The higher risk sits with small businesses and IT admins who set up remote access for a specific job and left it running.

Is this really a macOS-specific problem?

Not really. An authentication bypass on a remote-access service followed by a crypto miner is one of the oldest patterns in the book. The same script has played out on exposed Redis instances and misconfigured Docker APIs for years. What's new here is only the target and the CVE number. Anything listening on the public internet needs patching fast or firewalling off.