macOS Screen Sharing bypass exploited (CVE-2026-65400) [PoC]

Actively exploited in the wild - CVE-2026-65400 is a critical authentication bypass in macOS Screen Sharing (Sequoia 15.7.9 and earlier, Sonoma 14.8.9 and earlier, Tahoe 26.6.1 and earlier) that lets network attackers connect to a Mac without valid credentials. Apple has patched this in macOS Sequoia 15.7.9, Sonoma 14.8.9, and Tahoe 26.6.1; update immediately.

Overview

CVE-2026-65400 is an authentication logic flaw in the Screen Sharing service bundled with macOS. The vulnerability stems from improper state management during the authentication handshake. By exploiting this flaw, an attacker on the same network can bypass the credential check entirely and gain access to the Screen Sharing session, effectively taking control of the affected Mac’s display and input.

The vulnerability carries a CVSS score of 9.8 (Critical). The attack vector is network-based, requires no privileges, no user interaction, and has a low attack complexity. This means an unauthenticated remote attacker with network access to the target can exploit the flaw with minimal effort.

Apple has confirmed active exploitation in the wild, and CISA has added this CVE to its Known Exploited Vulnerabilities (KEV) catalog, underscoring the immediate threat to unpatched systems.

Affected Systems

• macOS Sequoia versions prior to 15.7.9
• macOS Sonoma versions prior to 14.8.9
• macOS Tahoe versions prior to 26.6.1

Remediation

Apple has released security updates addressing CVE-2026-65400. Administrators and users should apply the appropriate update immediately:

• Update to macOS Sequoia 15.7.9
• Update to macOS Sonoma 14.8.9
• Update to macOS Tahoe 26.6.1

For systems that cannot be patched immediately, disable Screen Sharing (System Settings > General > Sharing > Screen Sharing) as a temporary mitigation. Additionally, segment networks to limit exposure of macOS systems to untrusted network segments.

Organizations should prioritize patching internet-facing or heavily networked macOS endpoints, as the active exploitation indicates attackers are already leveraging this flaw.

Security Insight

Apple’s rapid patch cycle across three OS versions suggests the company is treating this as a top-priority incident, yet the presence of a network-facing authentication bypass in a core remote-access service highlights a recurring challenge in macOS security: the balance between usability and authentication rigor. This incident mirrors the pattern seen in Apple’s recent WebKit same-origin bypass, where a subtle state-management error created a critical security boundary failure. Meanwhile, macOS remains a growing target for attackers, as evidenced by malicious packages like the OpenClaw impostor that specifically target Mac users. For security teams, this is a reminder that remote-access services are high-value targets, and multi-factor authentication and network segmentation remain essential controls even on desktop operating systems.

Further Reading

• Apple Fixes WebKit Vulnerability Enabling Same-Origin
• Malicious npm Package Posing as OpenClaw Installer
• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs