CVE-2026-65400 grants remote root on exposed macOS screen sharing

Dutch NCSC reported active exploitation of CVE-2026-65400 last week. Attackers reached root on affected hosts after gaining initial access through the screen-sharing service. In every observed case a Monero miner was deployed. Apple shipped fixes for macOS Tahoe, Sequoia, and Sonoma the prior week. The flaw resides in state-management logic that fails to validate session transitions after a remote viewer connects.

Black Hat disclosure and the NCSC advisory supply the primary evidence. Severity is scored 7.1. Apple’s advisory used the qualifier “may” allow access without credentials, a wording pattern repeated across prior Apple CVEs that later proved reliable. Port 5900 exposure is the decisive precondition; systems behind NAT or with screen sharing disabled show no reported incidents.

The vulnerability connects to earlier Apple Remote Desktop issues tracked in 2023 and 2024 where state tracking similarly lagged behind protocol changes. Operational impact is immediate for any Mac left reachable on TCP 5900, a configuration still present in some enterprise and home setups. Patching alone does not close the exposure if screen sharing remains enabled.

Apple is expected to publish a broader security update within fourteen days. NCSC and CISA will likely issue coordinated guidance requiring port 5900 closure or MFA-enforced screen sharing. Enterprise telemetry from Jamf and Kandji should show patch adoption curves within the next thirty days.