started · updated
macOS Screen Sharing vulnerability exploited for Monero mining
A critical vulnerability in Apple’s macOS Screen Sharing feature, tracked as CVE-2026-65400, is being actively exploited by attackers to gain root access to internet-exposed Mac computers. The Netherlands National Cyber Security Centre (NCSC) reported that attackers are using the flaw to install Monero (XMR) cryptomining software, hijacking the computing power of compromised machines.
The vulnerability is an authentication-bypass flaw that allows remote attackers to connect to the Screen Sharing service via port 5900 without valid credentials. Because the exploit occurs prior to authentication, simply changing or removing Screen Sharing passwords does not protect vulnerable systems. Security firm Huntress identified tens of thousands of potentially vulnerable hosts, including many rented Macs used by hosting providers.
In response to the active exploitation, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) upgraded the vulnerability’s severity score from 7.1 to a critical 9.8 out of 10. Apple released emergency security updates on August 6 to address the issue. The patches are available for macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. Experts recommend that users immediately update their systems and disable Screen Sharing if it is not actively required.
Entities
Claims
What the coverage asserts, and how well corroborated each claim is across sources.
- [● 10 SOURCES] Attackers are actively exploiting a macOS Screen Sharing vulnerability to install Monero cryptominers. koinbulteni.com · cybernoz.com · bitcoinethereumnews.com · crypto.news · mycryptoparadise.com · +5 more
- [● 10 SOURCES] Exploitation of the vulnerability allows attackers to gain root access to affected systems. koinbulteni.com · cybernoz.com · bitcoinethereumnews.com · crypto.news · mycryptoparadise.com · +5 more
- [● 4 SOURCES] CISA upgraded the severity score of the CVE-2026-65400 vulnerability from 7.1 to 9.8. koinbulteni.com · bitcoinethereumnews.com · crypto.news · www.ithome.com
- [● 10 SOURCES] Attackers use the exploit to install Monero (XMR) mining software on compromised Macs. koinbulteni.com · cybernoz.com · bitcoinethereumnews.com · crypto.news · mycryptoparadise.com · +5 more
- [● 3 SOURCES] Security firm Huntress identified tens of thousands of potentially vulnerable hosts, many of which are rented Macs. koinbulteni.com · bitcoinethereumnews.com · crypto.news
- [● 8 SOURCES] The vulnerability targets systems where the Screen Sharing service is exposed via port 5900. cybernoz.com · bitcoinethereumnews.com · crypto.news · www.ithome.com · www.dday.it · +3 more
- [● 9 SOURCES] The security patch was released for macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. koinbulteni.com · cybernoz.com · bitcoinethereumnews.com · crypto.news · www.ithome.com · +4 more
- [● 4 SOURCES] Apple patched the authentication flaw through improved state management in macOS updates. cybernoz.com · crypto.news · www.ithome.com · www.macrumors.com