A bug in the macOS Screen Sharing feature allows remote hackers to log in without a password.
The Dutch National Cyber Security Centre warned earlier this week about an active vulnerability, CVE-2026-65400. It allowed attackers to gain root access and install a cryptominer.
The vulnerability, CVE-2026-65400, is located in the macOS Screen Sharing feature and has a severity score of 7.1 out of 10. Apple released security updates last week for macOS Tahoe, Sequoia, and Sonoma.
Attackers gain root access
The issue arises from an error in how macOS tracks the status of the Screen Sharing feature. An attacker can exploit the vulnerability to gain access to a Mac without valid login credentials.
According to the NCSC, several attacks have now been identified. In all investigated cases, the attackers had obtained root access to the affected system and subsequently installed a Monero miner. They use this to discreetly utilize the Mac’s processing power to mine cryptocurrencies.
As far as is known, the vulnerability is currently only being used for cryptomining. However, the obtained root privileges enable much more serious attacks, such as installing malware or stealing passwords and other sensitive data.
Update macOS and check Screen Sharing
Apple has since addressed CVE-2026-65400 in updates for macOS Tahoe, Sequoia, and Sonoma. Installing these is the most important measure against the attack.
Users are also advised to check whether Screen Sharing is actually necessary. The feature is located under System Settings > General > Sharing > Screen Sharing and can be disabled there.