Loading story…
Researchers disclosed a critical pre-authentication remote code execution flaw in Apple’s screensharingd daemon affecting macOS 26.5 and earlier when Screen Sharing is enabled. The bug lies in SRP frame-length validation: an oversized frame can trigger a residual success status, causing the service to treat authentication as completed and enter the post-authentication message loop without performing key exchange or establishing session cryptography. Public write-ups describe the issue as reachable over a single TCP connection and capable of bypassing authentication entirely.
The reported impact includes writing attacker-controlled files and escalating to root code execution, with one account saying the flaw was confirmed on a Mac mini M4 running macOS 26.3 and that exploitation can be intermittent depending on heap layout. Separate reporting also mentioned an additional SRP zero-key weakness that was not exploited in the demonstrated attack chain. Apple reportedly addressed the primary vulnerability in macOS 26.6 by correctly propagating the error code in screensharingd, closing the path to unauthenticated remote compromise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Apple fully patched the Screen Sharing vulnerability CVE-2026-65400 in macOS 26.6.1, 15.7.9, and 14.8.9. The 2026-08-06 releases extended remediation beyond the earlier macOS 26.6 fix and addressed affected older supported versions.
Apple fixed the primary screensharingd bug in macOS 26.6 by correctly propagating the error code in the SRP frame-length validation path. The article states macOS 26.6 was published on 2026-07-27 and that this release remediates the issue affecting macOS 26.5 and earlier.
A detailed write-up disclosed a critical pre-authentication vulnerability in Apple's screensharingd daemon, including exploitation details, dropped files, and a Python proof-of-concept named exploit.py. The report says the flaw enables authentication bypass and root code execution over a single TCP connection when Screen Sharing is enabled.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
bynar.io
Open sourcehuntress.com
Open sourcecyberveille.ch
Open sourcewarez.sl0p.foo
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple patched a logic flaw in macOS Screen Sharing, tracked as **CVE-2026-43760**, that allows remote attackers using legacy VNC password authentication to escalate to **root-level** file operations and command execution. The vulnerability affects the `screensharingd` service and its file-copy helpers when **Screen Sharing** or **Remote Management** is enabled with the **"VNC viewers may control screen with password"** option, because VNC-authenticated sessions are not mapped to a macOS user identity and the helpers continue running as root. Researchers showed the bug could be abused to read protected files and write attacker-controlled files into privileged locations, including `/private/etc/sudoers.d`, to grant a non-admin account passwordless `sudo` and obtain a fully remote interactive root shell. The flaw affects **macOS Tahoe prior to 26.6** and **macOS Sonoma prior to 14.8.8**, and defenders report it is being actively exploited in the wild to deploy **Monero cryptocurrency miners** on unpatched Macs. Apple rated the issue at 5.5 severity, while outside analysis said real-world impact could be significantly higher in exposed configurations. Apple released fixes in **macOS Tahoe 26.6** and **macOS Sonoma 14.8.8** and advised organizations that cannot patch immediately to disable the legacy VNC password option or turn off Screen Sharing and Remote Management to remove the attack path.
Aug 19, 2026
Apple released security updates for **macOS Tahoe 26.6.1**, **Sequoia 15.7.9**, and **Sonoma 14.8.9** to fix a Screen Sharing vulnerability that could let an attacker on the same network authenticate without valid credentials. The issue appears to primarily affect Macs where Screen Sharing has been explicitly enabled, and Apple said there is no evidence it has been exploited in the wild. Apple also noted that Tahoe 26.6.1 includes broader security fixes available through the standard Software Update mechanism. The updates follow disclosure of **`CVE-2026-39875`**, a CUPS flaw in macOS that allows an unprivileged local user to chain logic bugs in the privileged `cupsd` daemon and gain an arbitrary file-write capability as root. A public proof-of-concept showed how an attacker could register a malicious printer, capture and replay a valid CUPS authentication token, and abuse a `file://` device URI to write to attacker-chosen local paths outside SIP protection. Apple patched affected versions of Sonoma, Sequoia, and Tahoe, and defenders were urged to install updates quickly and watch for suspicious printer registrations, device URI changes, and print jobs targeting file-based destinations.
Aug 17, 2026
Researchers disclosed the first public bypass of Apple **Memory Integrity Enforcement (MIE)** on macOS 26.4.1 by chaining two vulnerabilities: `CVE-2026-64704` in **SMBClient** and `CVE-2026-64699` in **webdavfs**. The SMB flaw is a type confusion issue triggered when a macOS client connects to a malicious SMB server, causing the kernel to reinterpret a Resolve ID context as a lease context and misuse attacker-influenced kernel pointers. The WebDAV flaw is a kernel memory disclosure bug triggered by a crafted HTTP `206` response from a malicious WebDAV server, leaking uninitialized kernel memory to userspace. The researchers said the combined exploit chain produces arbitrary kernel read/write primitives and ultimately kernel code execution, allowing an unprivileged user to escalate privileges to **root** despite Apple’s layered kernel protections. Apple has patched both issues in macOS 26.6, and the disclosure was accompanied by a public exploit-development challenge and notice of a planned Black Hat USA presentation detailing the technique.
Jul 30, 2026