Apple Patches Critical macOS Screen Sharing Vulnerability (CVE-2026-65400)
Apple has released emergency security updates to address a severe remote code execution (RCE) vulnerability in macOS Screen Sharing, tracked as CVE-2026-65400. The flaw allows unauthenticated attackers to execute arbitrary code with root-level privileges on vulnerable systems, particularly those with Screen Sharing exposed to the internet.
The vulnerability affects multiple macOS versions, and Apple has issued patches in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9, released on August 6. Administrators are advised to deploy updates immediately or disable Screen Sharing as a temporary mitigation.
Technical Details & Exploitation
CVE-2026-65400 stems from a flaw in Apple’s Remote Framebuffer (RFB)/VNC implementation, specifically in the Secure Remote Password (SRP) authentication handling within the screensharingd service. A faulty frame-length validation path causes the service to incorrectly validate unauthenticated connections as legitimate, bypassing authentication entirely.
Unlike a previous Screen Sharing vulnerability (CVE-2026-43760, disclosed in late July), which required authenticated access, this flaw does not require valid macOS credentials or legacy VNC passwords. Successful exploitation grants attackers root-level access, including the ability to read, write, or modify files even those protected by macOS Transparency, Consent, and Control (TCC) safeguards.
The vulnerability is exacerbated by privileged helper processes (SSFileCopySender and SSFileCopyReceiver), which run with Full Disk Access entitlements, allowing attackers to bypass privacy restrictions. Public proof-of-concept exploits have demonstrated arbitrary file manipulation and remote code execution, with persistence achievable via LaunchDaemons or modified shell startup files.
Detection & Mitigation
Security teams can identify potential exploitation by monitoring for:
- Anomalous Screen Sharing events in Endpoint Security logs, where authentication_type is set to SRP (instead of RSA-SRP) and session_username appears as root (disabled by default in macOS).
- SSFileCopySender processes launching from screensharingd, often with arguments like "0 80", followed by unusual file access activity.
Since the flaw is pre-authentication, configuration hardening such as disabling legacy VNC or rotating credentials does not prevent exploitation. Organizations should:
- Inventory all Mac endpoints, prioritizing internet-exposed systems, including hosted Apple hardware and newly provisioned instances.
- Apply patches immediately (26.6.1, 15.7.9, or 14.8.9).
- Disable Screen Sharing and restrict remote administration at the network level if patching is not feasible.
The severity of CVE-2026-65400 underscores the risks of exposed remote management services, particularly on unpatched macOS systems.
Source: https://gbhackers.com/critical-macos-rce-vulnerability/
Apple cybersecurity rating report: https://www.rankiteo.com/company/apple
"id": "APP1786177624",
"linkid": "apple",
"type": "Vulnerability",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Users of macOS Tahoe, Sequoia, '
'and Sonoma with Screen Sharing '
'enabled',
'industry': 'Technology',
'location': 'Global',
'name': 'Apple',
'size': 'Large',
'type': 'Technology Company'}],
'attack_vector': 'Network',
'customer_advisories': 'Administrators are advised to deploy updates '
'immediately or disable Screen Sharing as a temporary '
'mitigation.',
'date_publicly_disclosed': '2026-08-06',
'date_resolved': '2026-08-06',
'description': 'Apple has released emergency security updates to address a '
'severe remote code execution (RCE) vulnerability in macOS '
'Screen Sharing, tracked as CVE-2026-65400. The flaw allows '
'unauthenticated attackers to execute arbitrary code with '
'root-level privileges on vulnerable systems, particularly '
'those with Screen Sharing exposed to the internet.',
'impact': {'operational_impact': 'Remote code execution with root-level '
'privileges, arbitrary file manipulation, '
'bypass of privacy restrictions',
'systems_affected': 'macOS systems with Screen Sharing exposed to '
'the internet'},
'lessons_learned': 'The severity of CVE-2026-65400 underscores the risks of '
'exposed remote management services, particularly on '
'unpatched macOS systems.',
'post_incident_analysis': {'corrective_actions': 'Patch deployment, disabling '
'Screen Sharing, enhanced '
'monitoring for exploitation '
'indicators',
'root_causes': 'Flaw in Apple’s Remote Framebuffer '
'(RFB)/VNC implementation, '
'specifically in the Secure Remote '
'Password (SRP) authentication '
'handling within the '
'*screensharingd* service. Faulty '
'frame-length validation path '
'causes the service to incorrectly '
'validate unauthenticated '
'connections as legitimate.'},
'recommendations': ['Inventory all Mac endpoints, prioritizing '
'internet-exposed systems',
'Apply patches immediately (macOS Tahoe 26.6.1, Sequoia '
'15.7.9, or Sonoma 14.8.9)',
'Disable Screen Sharing and restrict remote '
'administration at the network level if patching is not '
'feasible'],
'references': [{'date_accessed': '2026-08-06',
'source': 'Apple Security Advisory'}],
'response': {'communication_strategy': 'Public security advisory and patch '
'release',
'containment_measures': 'Disable Screen Sharing, restrict remote '
'administration at the network level',
'enhanced_monitoring': 'Monitor for anomalous Screen Sharing '
'events and SSFileCopySender processes',
'remediation_measures': 'Apply patches (macOS Tahoe 26.6.1, '
'Sequoia 15.7.9, Sonoma 14.8.9)'},
'title': 'Apple Patches Critical macOS Screen Sharing Vulnerability '
'(CVE-2026-65400)',
'type': 'Remote Code Execution (RCE)',
'vulnerability_exploited': 'CVE-2026-65400'}