CVE-2026-65400: Apple macOS Screen Sharing — Remote Root, Cryptomining Deployed (June 2026)

CVE-2026-65400 — Apple macOS Screen Sharing

CVE-2026-65400 is a high-severity vulnerability in Apple macOS Screen Sharing, enabling unauthenticated remote attackers to gain root access and deploy cryptominers. The flaw is actively exploited in the wild; immediate remediation is required.

Attack Vector

Attackers scan for internet-exposed macOS systems with Screen Sharing enabled (typically on port 5900). By exploiting CVE-2026-65400, they bypass authentication and escalate privileges to root, allowing arbitrary code execution. In this campaign, threat actors installed Monero cryptominers on compromised hosts. No credentials are required for exploitation, and any device with Screen Sharing accessible from the internet is at risk. Indicators of compromise include unexpected CPU spikes and outbound connections to Monero mining pools.

Who Is at Risk

All Apple macOS systems with Screen Sharing enabled and exposed to the internet are vulnerable. Approximately 40,000 devices have been identified as potentially affected. Both enterprise and individual users are at risk, with confirmed impact on Apple and multiple macOS user organizations in Europe.

Patch & Mitigate

• Patch: Apply the official Apple security update for CVE-2026-65400 immediately. Ensure all macOS endpoints are updated to the latest version released June 2026.
• Workaround: Disable Screen Sharing on all systems not requiring remote access. Restrict port 5900 to trusted IP ranges via firewall rules.
• Detect: Review logs for unauthorized Screen Sharing sessions, unexpected root logins, and high CPU usage. Monitor for outbound connections to known Monero mining pools.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers exploit exposed Screen Sharing to gain entry without credentials.
• TA0005 — Defense Evasion: Malicious cryptominer processes may attempt to hide activity or disable monitoring tools.
• TA0007 — Discovery: Adversaries may enumerate network and system information post-compromise.

Source: https://www.securityweek.com/recent-macos-screen-sharing-vulnerability-exploited-in-attacks/