Authentication‑Bypass Vulnerability (CVE‑2026‑65400) in macOS Screen Sharing Exploited for Monero Mining
What Happened — The Dutch NCSC reported active exploitation of CVE‑2026‑65400, an authentication‑bypass flaw in macOS’s built‑in Screen Sharing service (port 5900). Attackers on the same network could connect without valid credentials, gain root access, and install Monero cryptominers. Apple released patches for macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9 on August 6 2026.
Why It Matters for Compliance & Audit Readiness
- The scenario maps directly to SOC 2 CC6.1 (Logical Access) and CC7.1 (System Operations) – controls designed to prevent unauthorized remote access and ensure privileged‑account monitoring.
- Continuous evidence of patch management and configuration hardening (e.g., disabling unnecessary services) is required to demonstrate a defensible audit trail.
- Our SOC 2 Access Controls capability helps you capture real‑time proof that screen‑sharing ports are closed or monitored, and that updates are applied across the Mac fleet.
Who Is Affected — Any organization that runs macOS devices with Screen Sharing enabled, spanning technology, professional services, education, and finance.
Recommended Actions
- Deploy Apple’s August 6 patch to all macOS endpoints (Tahoe 26.6.1, Sequoia 15.7.9, Sonoma 14.8.9).
- Disable Screen Sharing unless explicitly required; if needed, restrict access to trusted IP ranges and enforce MFA for remote sessions.
- Integrate patch‑status and port‑exposure checks into your continuous compliance monitoring platform; map findings to SOC 2 CC6.1 and CC7.1 controls.
- Conduct a post‑patch audit to verify that no unauthorized persistence mechanisms remain.
Source: Malwarebytes Labs
Technical Notes — CVE‑2026‑65400 is an authentication‑bypass flaw in the Screen Sharing service (TCP 5900). Exploitation grants remote code execution at the root level, enabling cryptomining, credential harvesting, and lateral movement. The vulnerability was fixed via “improved state management” in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. Source: [NCSC advisory]