Apple has shipped emergency macOS updates to close a critical vulnerability in Screen Sharing, tracked as CVE-2026-65400, which allows unauthenticated remote attackers to execute arbitrary code and access files with root-level privileges.
The flaw is especially severe on systems where Screen Sharing is exposed to the public internet. Apple’s August 6 releases macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9 fully remediate the issue. Administrators should deploy the updates immediately or disable Screen Sharing entirely.
CVE-2026-65400 arrives close behind CVE-2026-43760, a separate Screen Sharing bug disclosed in late July. Both trace back to Apple’s Remote Framebuffer (RFB)/VNC implementation, but their exploitation requirements diverge sharply.
Critical macOS RCE Vulnerability
CVE-2026-43760 was an authenticated confused-context issue: a user who connected through legacy VNC authentication could abuse privileged file-operation helpers to read or create filesystem objects as root.
CVE-2026-65400 removes that prerequisite entirely; a remote attacker needs neither a valid macOS account nor the legacy VNC password to succeed.
Researcher Ryan Dowd traced the new flaw to screensharingd‘s Secure Remote Password (SRP) authentication handling. A faulty frame-length validation path returns a stale success state, causing the service to treat an unauthenticated connection as legitimately authenticated.
The resulting session also lacks the cryptographic protections a proper SRP exchange would normally provide. Public proof-of-concept research has already demonstrated arbitrary file reads and writes, and follow-on work has identified paths to full remote code execution, including persistence via LaunchDaemons or modified shell startup files.
The impact is magnified by Screen Sharing’s privileged helper processes, SSFileCopySender and SSFileCopyReceiver. Along the affected code path, SSFileCopySender can run with root privileges while carrying Apple’s private Full Disk Access entitlement, kTCCServiceSystemPolicyAllFiles.
That entitlement bypasses macOS Transparency, Consent and Control (TCC) protections, potentially exposing sensitive system and user data regardless of configured privacy settings.
Critically, configuration hardening does not help: removing approved Screen Sharing users, disabling legacy VNC authentication, or rotating VNC credentials will not block exploitation, because the vulnerability is triggered before authentication occurs.
Security teams should hunt for anomalous Endpoint Security Screen Sharing events. A successful malicious connection may show authentication_type set to SRP rather than RSA-SRP, with both session_username and authentication_username recorded as root anomalous because macOS disables the root account by default.
Telemetry may also reveal SSFileCopySender launching from the screensharingd bundle, often with arguments resembling "0 80", followed by unusual filesystem enumeration or file access activity.
Organizations should inventory all Mac endpoints, prioritize internet-reachable hosts, including hosted Apple hardware and freshly provisioned instances where remote management services may be enabled by default, and update to 26.6.1, 15.7.9, or 14.8.9 without delay.
Where immediate patching isn’t feasible, disable Screen Sharing and restrict remote administration at the network boundary. Due to the pre-authentication nature of CVE-2026-65400, patching is not the decisive control across every supported macOS deployment.
Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world
