CVE-2026-65400 Enables Pre-Auth Root on macOS Screen Sharing, 40k Hosts Exposed

The flaw in macOS Screen Sharing was patched in emergency updates for Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. NCSC-NL documented active exploitation where attackers gained root and installed cryptocurrency miners after scanning for open VNC ports. Researcher Alfredo Pesoli reported a post-authentication path involving legacy VNC password handling that escalates to file disclosure and sudoers modification. Independent researcher @osxreverser identified a distinct pre-authentication issue in screensharingd that bypasses credential checks entirely when the service is enabled.

Procurement and exposure data reveal the pattern: @osxreverser scans logged roughly 40,000 publicly reachable hosts, concentrated in US residential and university networks. This aligns with repeated incidents where remote desktop services on macOS remain internet-facing without SSH wrapping or network ACLs. Official Apple advisories describe state management fixes and credit only Pesoli, yet omit the pre-auth vector detailed in public researcher posts.

Contract and incident records show defense and enterprise fleets continue enabling Screen Sharing for management despite known daemon weaknesses. The combination of unauthenticated root primitives and high exposure count indicates systematic under-enforcement of least-privilege remote access policies. Follow-on activity will likely include lateral movement scripts targeting the same exposed cohort.

Next indicators to monitor are fresh Shodan or Censys deltas on port 5900 and any new miner campaigns linked to macOS hosts. Organizations should immediately disable internet exposure or enforce mandatory SSH tunneling with key-only authentication.