macOS screen sharing vulnerability exploited, hackers gain root access and deploy XMR mining program
According to the Netherlands National Cyber Security Centre (NCSC-NL), attackers are exploiting a serious authentication vulnerability CVE-2026-65400 in the macOS screen sharing feature to target Mac devices exposed to the internet. The vulnerability has a CVSS score of 9.8, allowing attackers to bypass authentication and gain system root access without valid credentials.NCSC-NL stated that multiple reports of active exploitation have been received, with the affected devices' port 5900 being directly accessible from the internet. In the currently confirmed cases, attackers have successfully obtained root access and deployed Monero (XMR) mining programs on the infected Mac devices. Apple has recently patched the vulnerability through macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. Security Affairs reminds users who have screen sharing enabled and have not yet updated their systems to complete the upgrade as soon as possible; if updating is temporarily not possible, they should disable the screen sharing feature to avoid exposing port 5900 to the internet.
