Hackers Exploit macOS Screen Sharing Auth Bypass (CVE‑2026‑65400) to Deploy Monero Miner
What Happened — The Dutch National Cyber Security Centre reported active exploitation of CVE‑2026‑65400, an authentication‑bypass flaw in macOS Screen Sharing (VNC 5900). Attackers gain unauthenticated root access and install a Monero cryptocurrency miner on systems where the port is exposed to the Internet.
Why It Matters for Compliance & Audit Readiness
- The flaw bypasses logical‑access controls, directly challenging SOC 2 CC6.1 (Logical Access Security) and the requirement to enforce credential validation.
- Continuous‑compliance programs must capture timely patch‑deployment evidence and demonstrate remediation of critical access‑control gaps.
- Network‑segmentation and remote‑desktop hardening are audit‑ready controls that mitigate the same vector in future assessments.
Who Is Affected — Any organization that runs macOS devices with Screen Sharing enabled and allows inbound TCP 5900, notably remote‑work environments, tech‑SaaS firms, and professional services that standardize on Apple hardware.
Recommended Actions
- Apply the Apple security update (macOS Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9) without delay.
- If patching cannot be immediate, disable Screen Sharing (System Settings → Sharing → Screen Sharing) and block inbound port 5900 at the perimeter firewall.
- Deploy continuous monitoring for privileged‑account activity and unexpected mining processes; retain logs as SOC 2 audit evidence.
- Update access‑control policies to require multi‑factor authentication for any remote‑desktop service.
Technical Notes — CVE‑2026‑65400 is an authentication bypass in the macOS Screen Sharing service (VNC over TCP 5900). Exploitation grants attackers root privileges, enabling arbitrary command execution and the deployment of a Monero miner. Apple released a fix on 8 August 2026 for macOS Tahoe 26.6.1 and later. Source: BleepingComputer