Loading story…
Apple patched a logic flaw in macOS Screen Sharing, tracked as CVE-2026-43760, that allows remote attackers using legacy VNC password authentication to escalate to root-level file operations and command execution. The vulnerability affects the screensharingd service and its file-copy helpers when Screen Sharing or Remote Management is enabled with the "VNC viewers may control screen with password" option, because VNC-authenticated sessions are not mapped to a macOS user identity and the helpers continue running as root. Researchers showed the bug could be abused to read protected files and write attacker-controlled files into privileged locations, including /private/etc/sudoers.d, to grant a non-admin account passwordless sudo and obtain a fully remote interactive root shell.
The flaw affects macOS Tahoe prior to 26.6 and macOS Sonoma prior to 14.8.8, and defenders report it is being actively exploited in the wild to deploy Monero cryptocurrency miners on unpatched Macs. Apple rated the issue at 5.5 severity, while outside analysis said real-world impact could be significantly higher in exposed configurations. Apple released fixes in macOS Tahoe 26.6 and macOS Sonoma 14.8.8 and advised organizations that cannot patch immediately to disable the legacy VNC password option or turn off Screen Sharing and Remote Management to remove the attack path.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
BleepingComputer confirmed that attackers were actively exploiting CVE-2026-43760 against unpatched macOS systems with Screen Sharing or Remote Management enabled and VNC password authentication turned on. Reported abuse included deploying Monero cryptocurrency miners after gaining root-level access.
Apple patched the macOS Screen Sharing logic flaw CVE-2026-43760 in macOS Tahoe 26.6 and macOS Sonoma 14.8.8. The fixes were released on July 27, 2026, and Apple advised users who could not update to disable the legacy VNC password option or turn off Screen Sharing and Remote Management.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
isc.sans.edu
Open sourcecert.ug
Open sourcecybersecuritynews.com
Open sourcebugflation.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple released security updates for **macOS Sequoia 15.7.9** and **macOS Sonoma 14.8.9** to fix `CVE-2026-65400`, an authentication flaw in **Screen Sharing** that could let an attacker on the network log in without valid credentials. Apple said the bug was caused by an authentication issue and was remediated through improved state management; the company also issued a corresponding fix for **macOS Tahoe 26.6.1**. The vulnerability was reported by Alfredo Pesoli (`@__rev`) via Bynario Atlas. The flaw is now being actively exploited after public exploit code became available. According to reporting citing the Netherlands’ National Cyber Security Centre, attackers have targeted systems with **VNC port `5900`** exposed to the internet, gained **root** access, and deployed a **Monero** cryptocurrency miner. Organizations running affected macOS systems have been urged to apply Apple’s updates immediately or disable Screen Sharing until patching is complete.
Aug 20, 2026
Researchers disclosed a critical pre-authentication remote code execution flaw in Apple’s `screensharingd` daemon affecting macOS 26.5 and earlier when Screen Sharing is enabled. The bug lies in SRP frame-length validation: an oversized frame can trigger a residual success status, causing the service to treat authentication as completed and enter the post-authentication message loop without performing key exchange or establishing session cryptography. Public write-ups describe the issue as reachable over a single TCP connection and capable of bypassing authentication entirely. The reported impact includes writing attacker-controlled files and escalating to **root** code execution, with one account saying the flaw was confirmed on a Mac mini M4 running macOS 26.3 and that exploitation can be intermittent depending on heap layout. Separate reporting also mentioned an additional SRP zero-key weakness that was not exploited in the demonstrated attack chain. Apple reportedly addressed the primary vulnerability in macOS 26.6 by correctly propagating the error code in `screensharingd`, closing the path to unauthenticated remote compromise.
Aug 10, 2026
Apple released security updates for **macOS Tahoe 26.6.1**, **Sequoia 15.7.9**, and **Sonoma 14.8.9** to fix a Screen Sharing vulnerability that could let an attacker on the same network authenticate without valid credentials. The issue appears to primarily affect Macs where Screen Sharing has been explicitly enabled, and Apple said there is no evidence it has been exploited in the wild. Apple also noted that Tahoe 26.6.1 includes broader security fixes available through the standard Software Update mechanism. The updates follow disclosure of **`CVE-2026-39875`**, a CUPS flaw in macOS that allows an unprivileged local user to chain logic bugs in the privileged `cupsd` daemon and gain an arbitrary file-write capability as root. A public proof-of-concept showed how an attacker could register a malicious printer, capture and replay a valid CUPS authentication token, and abuse a `file://` device URI to write to attacker-chosen local paths outside SIP protection. Apple patched affected versions of Sonoma, Sequoia, and Tahoe, and defenders were urged to install updates quickly and watch for suspicious printer registrations, device URI changes, and print jobs targeting file-based destinations.
Aug 17, 2026