Improper Authentication in macOS Screen Sharing (CVE‑2026‑65400) Enables Network‑Based Unauthorized Access
What It Is – Apple macOS contains an authentication flaw in the built‑in Screen Sharing service that allows an attacker on the same network to establish a remote session without presenting valid credentials.
Exploitability – The vulnerability is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. A CVSS score has not been published yet, but the KEV status signals high risk.
Affected Products – Apple macOS (all versions that include the Screen Sharing component).
Why It Matters for Trust & Control Assurance
- Undermines the access‑control objective that auditors expect to see enforced for remote services.
- Highlights the need for continuous monitoring of privileged remote sessions to provide defensible evidence of proper authentication.
- Demonstrates why enterprises must maintain audit‑ready documentation of patch management and remote‑access policies to satisfy multiple compliance frameworks.
Recommended Actions
- Deploy Apple’s security update that patches CVE‑2026‑65400 as soon as it is available.
- If patching cannot be applied immediately, disable Screen Sharing or restrict it to trusted network zones.
- Enforce multi‑factor authentication (MFA) for any remote‑desktop tools and ensure all Screen Sharing connections are logged.
- Integrate Screen Sharing activity into your continuous‑monitoring pipeline to capture evidence for audit readiness.
Source: CISA KEV – CVE‑2026‑65400