The warning went public on 14 August, eight days after Apple shipped the fix: NCSC-NL had been told the flaw was being exploited. What the attackers walk away with is root on any Mac still answering on port 5900, and at no point does a password come into it.
The flaw is CVE-2026-65400, an authentication bypass in the Screen Sharing service built into macOS. Every case reported to the Dutch national cyber security centre so far has ended the same way: root access, followed by a Monero cryptocurrency miner dropped on the machine.
Timeline: eight days between the patch and the warning
The bug did not arrive alone. It belongs to a cluster of problems in the macOS Screen Sharing server that Apple worked through across a fortnight, and that sequence explains why so many people lost track of what had actually been fixed.
On 27 July Apple shipped the 26.6, 15.7.8 and 14.8.8 wave. On 29 July two pieces of research landed the same day: one on a post-authentication bug, another pointing at a pre-authentication problem in the service daemon itself. By the start of August public proof-of-concept code was circulating. On 6 August Apple released the update that closes CVE-2026-65400 in macOS Tahoe 26.6.1, Sequoia 15.7.9 and Sonoma 14.8.9. Eight days later the NCSC-NL warning was reported by BleepingComputer and The Hacker News.
For a service of this kind, that window closes before the item reaches a change advisory board.
One note on severity, because the sources disagree: the NVD entry scores the flaw 9.8 out of 10, while SC Media published 7.1. The number should not drive the patching decision. Two facts settle it: exploitation is confirmed, and no credentials are required.
What actually breaks, conceptually
Screen Sharing is the remote desktop feature shipped with macOS. It speaks RFB, the protocol underneath VNC, over TCP port 5900, and it accepts two authentication paths: Apple's native one, against a real system account, and a legacy VNC path using a single password tied to no particular user.
The native path relies on SRP, a secure remote password protocol. Huntress describes the defect in terms any developer will recognise: the service daemon checks the length of an incoming frame and, when that frame is oversized, returns a success value left over from the preceding operation. The state machine reads it as "this authentication step passed" and moves on. The session then continues in cleartext, unencrypted.
Apple's advisory summarises it as an authentication issue addressed with improved state management, and credits the finding to researcher Alfredo Pesoli of Bynario. There is no memory corruption, no race to win, no memory protection to defeat: it is a logic bug. That makes it deterministic rather than opportunistic against an unpatched machine.
In practice it yields arbitrary file read and write as root, by way of the helper processes the service uses for file copying. One of those helpers carries a private Apple-signed entitlement granting Full Disk Access, which sidesteps the system's TCC privacy framework entirely.
Two identifiers get confused daily. CVE-2026-43760 is a post-authentication bug: the attacker must already hold the legacy VNC password. CVE-2026-65400 demands nothing of the sort. Per Calif's analysis, all it needs is the name of an existing account, and usernames are not secrets: macOS prints them on the login window.
Why the usual hardening does nothing here
Trained reflexes fail at this point. Removing the accounts allowed to connect remotely changes nothing. Disabling legacy VNC password authentication does nothing either. Nor does rotating that password. The bug fires before any of those checks come into play, so configuration hardening does not reduce exposure at all.
Two measures work: install the update or switch the service off.
Who is genuinely exposed?
Screen Sharing is not enabled by default, which is the good news. The bad news is where it is enabled.
Huntress points to one concentration: hosted Mac providers, the rental Mac minis that have become routine for building Apple software or running occasional workloads. Several of those providers hand the machine over with SSH and Screen Sharing already on, and some were still provisioning images built on pre-fix versions. A cursory Censys search, the firm notes, surfaces tens of thousands of potentially vulnerable hosts. An independent researcher quoted by The Hacker News puts it at roughly 40,000 open Screen Sharing services on the internet, mostly residential, with the remainder split between universities and companies.
The second concentration appears on no server inventory, and it is the one that should worry a European organisation: the director's Mac, the design team's Mac, the developer who once turned Screen Sharing on so a colleague could help remotely and never turned it off. Behind office NAT that machine is not internet-facing, but it is wide open to anyone already on the internal network. Very little is needed to close that distance: a port forward on a branch office router, a connection from home, a poorly segmented guest network.
The bias is always the same: attack surface gets inventoried on servers and forgotten on workstations, and among workstations, Macs tend to fall into no-man's-land between the systems team and the security team. On attack surface management engagements we run into that pattern repeatedly: remote administration services listening on machines nobody classified as infrastructure.
The miner is the warning, not the damage
What NCSC-NL observed in every reported case is the same: root access and a Monero miner dropped on the box. This is textbook cryptojacking, the unauthorised use of someone else's resources to mine cryptocurrency, and it follows the usual logic: monetise fast and indiscriminately, across everything reachable by automation. It is the same stolen-compute economy we examined in the case of hijacked AI inference capacity.
Reading that as "only a miner" would be a mistake. The miner proves the root access works and is automated; who uses it next is a matter of opportunity. A machine offering root to third parties can surrender stored passwords, session tokens for corporate tooling, SSH keys, documents and mail. NCSC-NL has not said when the attacks began, how many systems are affected, or whether the activity extends beyond mining.
There is also a signal here that outlives this particular flaw. Calif, which analysed both bugs, says it built working exploit code for the pair in four hours with the help of an AI agent, and that it is withholding further detail until most machines are patched. If that figure holds as a norm, the window between a patch shipping and mass exploitation narrows for every vendor, and monthly patch planning stops matching the attacker's tempo.
Detection: what to look for on a Mac
The useful telemetry exists and comes from the operating system itself. Endpoint Security is Apple's framework for security tooling to observe system events, and since macOS 13 it emits dedicated Screen Sharing attach and detach events.
Huntress documents two usable signals in those events. The first is the session username: a connection established as root has no legitimate explanation in most estates, because that account is disabled by default on macOS and enabling it for remote desktop is unusual. The second is the authentication type: legitimate native connections show as RSA-SRP, whereas sessions opened through this flaw register as plain SRP, without the cryptographic layer. Telling one from the other is a straightforward correlation rule to write.
From there, watch the service's file-copy helper touching paths that have nothing to do with a support session, and executions of that helper with anomalous attributes. Attempts to guess account names leave a noisy trail of their own: attach events with an empty session username.
At the network layer the job is simpler and the payoff is bigger: inventory what listens on port 5900 across the estate, then check from outside whether any of it answers. Sustained outbound connections to mining pools and CPU consumption that does not match what the machine should be doing complete the picture. A managed SOC with genuine macOS coverage sees both; one ingesting only Windows telemetry sees neither.
What to do this week
Updating is the primary measure and it cannot wait: macOS Tahoe 26.6.1, Sequoia 15.7.9 or Sonoma 14.8.9. Those are the only builds that close the pre-authentication bug.
Where the update cannot land today, switching Screen Sharing off in System Settings, under General → Sharing, is an effective stopgap. And as a standing rule: if someone needs remote desktop on a Mac, route it over VPN or an SSH tunnel, never with port 5900 facing the internet.
Widen the sweep beyond the machines where the service is believed to be on. Huntress recommends updating the whole macOS estate even where Screen Sharing is assumed to be disabled, simply because that assumption fails more often than anyone likes to admit. For machines rented from hosted Mac providers, verify the provisioning image version as well.
If a compromised machine turns up, treat it like any root-level compromise: incident response means isolating it, rebuilding from scratch and rotating every password, key and session that passed through it, cloud services included. Removing the miner and closing the ticket does nothing about whatever the attacker already took.
For organisations wanting a methodical answer on which remote administration services they actually expose, at Hard2bit we handle that review inside vulnerability management: that is where this class of finding surfaces before somebody else finds it. Choosing a cybersecurity company that covers macOS in the same detail as Windows stops being a nicety when the month's flaw sits on the managing director's laptop.
The service nobody inventoried
An operating system much of the industry treats as the safe one by default has just given away root without credentials, through a feature you enable with a switch and forget in the same motion. There is no macOS-versus-Windows argument here. There is an inventory problem.
So the useful exercise this week is not the patch, which is settled, but the count: how many remote administration services are still listening on machines nobody files under infrastructure. In the estates we review, that number has usually never been measured.
This article is defensive and educational in nature. The detection and hardening guidance described should be adapted and tested in each environment before production use. Details of the exploitation are drawn from public disclosures available at the time of publication (August 2026) and may evolve.
