Home · Wiki · Incidents & Campaigns

type: incident · created: 2026-08-15 · updated: 2026-08-15 · tags: [incident, active-exploitation, apple, macos, rce, crypto-mining, sector-global-macro] · confidence: high · affected_sectors: [global-macro] · au_impact: false

Vulnerability Giving Attackers Full Control of Macs Is Under Active Exploitation

Source: Ars Technica
Date: 2026-08-15
Reliability: Tier 2/4 — Established cyber journalism
Entity: Apple macOS (Screen Sharing)

Summary

Ars Technica reports that CVE-2026-65400 — a flaw in macOS Screen Sharing state management — is under active exploitation. An unauthenticated remote attacker can log in to a Mac without a password, view the screen, and take control of the keyboard and mouse. The Netherlands NCSC warned of active attacks on systems with port 5900 exposed; observed intrusions obtained root and installed a Monero cryptocurrency miner. Apple shipped patches for macOS Tahoe, Sequoia and Sonoma within the last week.

Key Facts

CVSS 7.1 authentication bypass in macOS Screen Sharing
Affects systems with Screen Sharing exposed on port 5900
Exploitation observed in the wild; attackers achieved root and installed a crypto-miner
Apple patches now available for Tahoe, Sequoia and Sonoma

Sector

Global (Macro) — Internet-exposed Screen Sharing services form a broad cross-sector attack surface.

Source

https://arstechnica.com/security/2026/08/vulnerability-giving-attackers-full-control-of-macs-is-under-active-exploitation/

Reliability

Tier 2 — Established cyber journalism; incident status confirmed.

Date

2026-08-15

Cve 2026 65400 Macos Screen Sharing Rce — Vulnerability entry with technical detail

Sources: raw/digests/Cyber-Digest-2026-08-15.md