Microsoft and Apple Rush Out Patches for Flaws That Let Attackers In Without a Password
Several of the Microsoft bugs score a perfect 10 out of 10 for severity. Apple quietly fixed a flaw that lets someone access your screen without logging in.
Key points
- Microsoft patched more than a dozen security flaws on 6 August 2026, including three rated the maximum possible severity of 10 out of 10.
- The three perfect-score flaws affect Planetary Computer Pro, Azure SQL Database, and Microsoft Teams, and all can be exploited by attackers working remotely over a network.
- Four additional Microsoft flaws scored 9.9 out of 10 and affect Azure Service Bus, Azure SRE Agent, Microsoft Entra (the company's identity management service), and Active Directory (the system most organisations use to manage employee logins).
- Apple patched a single flaw, CVE-2026-65400, that could let someone access another computer's screen without supplying a valid username or password.
- Apple's fix is available now in three macOS updates: macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9.
What actually happened here?
Microsoft and Apple each shipped emergency security patches this week, closing gaps that criminals could use to break into systems without needing a password. Both companies released fixes on the same day, 6 August 2026, as first noted by SecurityWeek.
Microsoft's list is the longer of the two. Three of its vulnerabilities, security flaws that let attackers do something they should not be able to do, carry the highest possible danger rating: 10 out of 10 on the CVSS scale, which is the industry's standard severity scorecard.
All three involve missing or broken authentication, meaning the software does not properly check whether the person asking for access is allowed to be there.
| CVE ID | Product | What the flaw does | CVSS Score |
|---|---|---|---|
| CVE-2026-63508 | Planetary Computer Pro | Missing authentication, lets attacker gain higher access | 10.0 |
| CVE-2026-56162 | Azure SQL Database | Broken authentication, lets attacker gain higher access | 10.0 |
| CVE-2026-65667 | Microsoft Teams | Missing authorisation check, lets attacker gain higher access | 10.0 |
| CVE-2026-50515 | Azure Service Bus | Remote code execution, lets attacker run their own commands | 9.9 |
| CVE-2026-65400 | macOS Screen Sharing | Bypasses login, lets attacker view your screen remotely | 7.5 |
Should ordinary computer users be worried?
For most home users, the Apple fix is the one to act on today. If your Mac has Screen Sharing turned on, meaning your computer is set up so someone can view or control it remotely, an attacker on the same network could connect without knowing your password. That is a real problem in shared offices, cafes, and apartment buildings with shared Wi-Fi.
Update your Mac now. Go to System Settings, click General, then Software Update.
For businesses running Microsoft software, the Teams and Active Directory flaws deserve immediate attention. Active Directory is the gatekeeper system used by almost every company to control which employees can access which files and systems. A flaw there that lets attackers elevate their privileges, meaning climb to a higher level of access than they were granted, is exactly the kind of gap that ransomware groups, which are criminal organisations that lock company data and demand payment to restore it, use to move from one infected machine to an entire network.
What should IT teams do right now?
Apply the Microsoft patches immediately, starting with anything touching Azure SQL, Teams, and Active Directory. The failure mode here is the usual one: a patch sits in a testing queue for two weeks while someone schedules a change window, and by day four an exploit is circulating.
For the Azure-hosted services, Microsoft will apply cloud-side fixes automatically in many cases, but verify that in your Azure portal. Do not assume.
One thing the post-mortem will say, if this bites anyone: the authentication gaps in Planetary Computer Pro and Azure SQL were rated maximum severity and still needed a human being to push the button.
Patch fast. Verify the patch actually applied.
