Loading story…
Multiple vulnerabilities in macOS Screen Sharing’s screensharingd daemon exposed privileged file operations and enabled remote root-level compromise. CVE-2026-43760 required a configured legacy VNC password, while a separate flaw disclosed by Pedro Vilaça bypassed authentication through an incorrect return value in the daemon’s authentication logic. Apple patched both issues on July 27, 2026. Another independent authentication bypass, CVE-2026-65400, prompted additional out-of-band macOS updates on August 6. Researchers demonstrated that the authentication bypasses exposed privileged file-copy functionality capable of supporting root-level compromise.
NCSC-NL and Microsoft subsequently reported attacks against Internet-exposed Macs in which attackers obtained root access and installed persistent XMRig cryptocurrency miners. The reports establish exploitation of the Screen Sharing weaknesses, although the supplied details do not attribute individual attacks to a specific flaw or identify affected macOS versions. Organizations should verify deployment of Apple’s applicable fixes, remove direct Internet exposure of Screen Sharing, disable unnecessary remote-access services and legacy VNC authentication, and investigate exposed Macs for unauthorized privileged file changes, persistence, and cryptocurrency-mining activity.
See which actors are running it and whether you're in range.
9 events from the most recent confirmed update back to the earliest known activity.
The Netherlands National Cyber Security Centre updated advisory NCSC-2026-0280 to report active exploitation. Multiple compromised Macs exposed TCP port 5900 directly to the Internet, and every reported case involved root access and installation of a Monero cryptocurrency miner.
Apple released macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9 to address CVE-2026-65400. Apple said the flaw allowed network attackers to authenticate without valid credentials and credited Alfredo Pesoli via Bynario Atlas.
Pedro Vilaça published the existence of an independently discovered authentication bypass requiring network access to a Screen Sharing-enabled Mac but no VNC password. He found that macOS 26.6 had already fixed the flaw, which received no separate public CVE assignment.
Bynario researcher Alfredo Pesoli publicly described CVE-2026-43760, showing that Screen Sharing's file-copy helpers retained root filesystem authority after legacy VNC authentication. Exploitation required the configured VNC password and could enable root command execution through attacker-created security-sensitive files.
Apple released macOS Tahoe 26.6 and Sonoma 14.8.8 with a fix for CVE-2026-43760, which allowed privileged file operations after legacy VNC authentication. The July 27 updates also fixed Pedro Vilaça's independently discovered authentication bypass, which he later suggested was inadvertently addressed by the CVE-2026-43777 fix.
Microsoft Threat Intelligence reported similar compromises involving transferred scripts, an SSH public key, configuration changes, log deletion, and altered Packet Filter settings. Attackers installed XMRig 6.26.0 at .config/sysmond, launched it as com.apple.airportd, and configured a KeepAlive LaunchDaemon to maintain persistence.
Calif compared macOS 26.6 with 26.6.1 and concluded that CVE-2026-65400 was a separate authentication state-machine desynchronization that remained exploitable after Vilaça's stale-return flaw had been fixed. Calif reported reconstructing working exploits for both bypasses through binary comparisons, completing its analysis within hours.
Researcher bl4sty reverse-engineered navi_the_clown and traced its authentication bypass to oversized SRP frames causing an error path to return a stale success value. The resulting unauthenticated root file-read and file-write primitives supported root code execution, including a subsequently validated path on SIP-enabled macOS.
Vilaça released the intentionally limited, obfuscated navi_the_clown proof of concept, demonstrating arbitrary remote file disclosure while withholding the protocol flaw and full exploitation chain. Its use of privileged file-copy infrastructure could bypass macOS TCC privacy controls.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
iru.com
Open sourcetheevilbit.github.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple patched a logic flaw in macOS Screen Sharing, tracked as **CVE-2026-43760**, that allows remote attackers using legacy VNC password authentication to escalate to **root-level** file operations and command execution. The vulnerability affects the `screensharingd` service and its file-copy helpers when **Screen Sharing** or **Remote Management** is enabled with the **"VNC viewers may control screen with password"** option, because VNC-authenticated sessions are not mapped to a macOS user identity and the helpers continue running as root. Researchers showed the bug could be abused to read protected files and write attacker-controlled files into privileged locations, including `/private/etc/sudoers.d`, to grant a non-admin account passwordless `sudo` and obtain a fully remote interactive root shell. The flaw affects **macOS Tahoe prior to 26.6** and **macOS Sonoma prior to 14.8.8**, and defenders report it is being actively exploited in the wild to deploy **Monero cryptocurrency miners** on unpatched Macs. Apple rated the issue at 5.5 severity, while outside analysis said real-world impact could be significantly higher in exposed configurations. Apple released fixes in **macOS Tahoe 26.6** and **macOS Sonoma 14.8.8** and advised organizations that cannot patch immediately to disable the legacy VNC password option or turn off Screen Sharing and Remote Management to remove the attack path.
Aug 20, 2026
Apple released security updates for **macOS Sequoia 15.7.9** and **macOS Sonoma 14.8.9** to fix `CVE-2026-65400`, an authentication flaw in **Screen Sharing** that could let an attacker on the network log in without valid credentials. Apple said the bug was caused by an authentication issue and was remediated through improved state management; the company also issued a corresponding fix for **macOS Tahoe 26.6.1**. The vulnerability was reported by Alfredo Pesoli (`@__rev`) via Bynario Atlas. The flaw is now being actively exploited after public exploit code became available. According to reporting citing the Netherlands’ National Cyber Security Centre, attackers have targeted systems with **VNC port `5900`** exposed to the internet, gained **root** access, and deployed a **Monero** cryptocurrency miner. Organizations running affected macOS systems have been urged to apply Apple’s updates immediately or disable Screen Sharing until patching is complete.
Aug 31, 2026
Researchers disclosed a critical pre-authentication remote code execution flaw in Apple’s `screensharingd` daemon affecting macOS 26.5 and earlier when Screen Sharing is enabled. The bug lies in SRP frame-length validation: an oversized frame can trigger a residual success status, causing the service to treat authentication as completed and enter the post-authentication message loop without performing key exchange or establishing session cryptography. Public write-ups describe the issue as reachable over a single TCP connection and capable of bypassing authentication entirely. The reported impact includes writing attacker-controlled files and escalating to **root** code execution, with one account saying the flaw was confirmed on a Mac mini M4 running macOS 26.3 and that exploitation can be intermittent depending on heap layout. Separate reporting also mentioned an additional SRP zero-key weakness that was not exploited in the demonstrated attack chain. Apple reportedly addressed the primary vulnerability in macOS 26.6 by correctly propagating the error code in `screensharingd`, closing the path to unauthenticated remote compromise.
Aug 10, 2026