macOS's screen sharing feature has been the target of a cyberattack campaign that has compromised the security of Mac computers. The National Cyber ​​Security Centre of the Netherlands (NCSC-NL) has confirmed that the vulnerability, which Apple has since patched, was exploited in the wild to install a Monero cryptocurrency miner.
The vulnerability, registered as CVE-2026-65400, affects macOS versions Sequoia 15.7.9, Sonoma 14.8.9, and Tahoe 26.6.1. Attackers could authenticate to the feature without valid credentials , allowing them to remotely take control of the computer and access the screen, keyboard, and mouse.
Details of the vulnerability and its exploitation
The problem lies in the fact that the Screen Sharing feature, when active, exposes port 5900 to the internet. The NCSC-NL observed several systems with this port accessible from the network , and on all of them, root access was obtained and a Monero miner was installed. This means that the affected Mac's resources are being used to mine cryptocurrency without the user's consent.
Apple released security updates on August 6 for the three versions mentioned. Initially, the company stated there was no evidence of active exploitation , but a notification from the NCSC-NL, reported by Ars Technica, refuted this claim. The patch is based on "enhanced state management" that prevents unauthorized authentication.
Recommendations for users
If you have a Mac, the most urgent thing to do is update your operating system to the latest version . You can check this in System Settings > General > Software Update. Don't hesitate: the patches are already available and are the only way to close this gap.
Additionally, it's a good idea to check if the Screen Sharing feature is enabled and limit its use . If you don't need it, disable it. It's also recommended to use a VPN to improve security when it's enabled, and to be wary of third-party applications that request screen sharing permissions, as they could be an attack vector.
Finally, monitor your computer's activity for unusual behavior, such as high CPU usage or suspicious processes running on the system . If you suspect you've been a victim, change your passwords and contact a professional.
In short, the vulnerability in macOS Screen Sharing has been actively exploited, but Apple has already implemented fixes. The key is to update as soon as possible and maintain good security practices to prevent cybercriminals from taking advantage of your computer.
