CVE-2026-65400: The Screen Sharing Bug That Turned Macs Into Monero Miners
I still remember the first time I found a client's VNC port wide open on the public internet, back when "remote desktop" meant duct-taping RealVNC to a Windows XP box and hoping nobody noticed. Fifteen years later, Apple's own Screen Sharing feature just proved that some lessons never stick. Port 5900, the classic VNC port, is once again the villain of the story.
Here's what happened. Apple shipped patches for CVE-2026-65400 across Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9 on August 6, 2026. The advisory is dry, corporate-Apple dry, describing a "state-management flaw" that could let a network attacker authenticate to Screen Sharing without valid credentials. Translation: someone could knock on the door, skip the part where they show ID, and walk right in.
The Netherlands National Cyber Security Centre didn't wait for theoretical proof. They found it happening in the wild.
<> Dutch officials observed active exploitation on multiple systems with TCP port 5900 exposed to the internet — attackers obtained root access before installing a Monero cryptocurrency miner./>
That's not a hypothetical CVSS score exercise. That's someone's Mac mini quietly grinding out cryptocurrency for a stranger while its actual owner wonders why the fans won't stop.
What actually happened, in plain terms:
- A pre-authentication bug in Screen Sharing let attackers bypass login entirely
- Exposed systems on port 5900 were compromised and rooted
- Attackers deployed Monero miners after gaining control
- Apple rated it 7.1/10; Huntress called it more serious, citing pre-auth RCE potential
- Fix requires updating to Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9
The severity mismatch here is worth dwelling on. Apple's language is careful, almost clinical: "authenticate without valid credentials." Huntress and others are calling it pre-authentication remote code execution, which is a much scarier phrase to put in a headline. Both can be true. Apple tends to undersell; security vendors tend to oversell. Somewhere in the middle is the truth, and the truth is bad enough — root access is root access, regardless of what euphemism gets it there.
What annoys me most isn't the bug itself. Bugs happen. State-management flaws in authentication flows are genuinely hard to catch in code review — that's exactly the kind of edge case that slips through QA because it only manifests under specific session-timing conditions. What annoys me is that anyone still has Screen Sharing exposed directly to the internet in 2026. This isn't new advice. This has been the advice since the Bush administration.
For developers building remote-access tooling, MDM platforms, or anything VNC-adjacent, the lesson is uncomfortably familiar:
1. Never assume authentication state persists correctly across reconnects or edge-case network conditions
2. Segment remote-management traffic behind VPNs or bastion hosts, full stop
3. Audit session handling and protocol edge cases like they're going to be exploited, because they will be
4. If your MDM policy doesn't explicitly block port 5900 exposure, it's not a policy — it's a hope
Apple noted the bug mainly affects users who manually enabled Screen Sharing, which is meant to be reassuring. It isn't. Plenty of small businesses, freelancers, and remote IT shops enable it precisely because they need remote access and don't know better than to expose it directly rather than tunneling through something safer.
My Bet: This won't be the last time a decades-old remote-access protocol embarrasses a major OS vendor. Screen Sharing, RDP, VNC — these tools were designed for a smaller, more trusting internet, and patch cycles keep papering over architecture that should've been rebuilt a decade ago. Expect at least one more "actively exploited" headline tied to legacy remote-desktop protocols before this year is out, and expect the postmortem to sound almost identical to this one.
