Active Exploitation of macOS Screen Sharing Flaw Leads to Monero Miner Infections

Key points

• CVE-2026-65400 is a flaw in macOS screen sharing state management that allows unauthenticated remote access.
• The NCSC reported active exploitation where attackers gained root access and installed Monero miners.
• Apple released patches on August 6, 2026, for macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9.
• The vulnerability is rated 7.1 out of 10 in severity and requires port 5900 to be exposed to the internet.
• Security experts recommend disabling screen sharing when not in use or connecting via VPN/SSH tunnels instead.

Background

This incident follows a pattern of remote access vulnerabilities in software platforms, such as recent Zoom flaws that allowed device hijacking via AI-assisted prompts. In July 2026, Microsoft also patched two actively exploited zero-days in SharePoint and AD FS, highlighting a broader trend of unauthenticated remote code execution vulnerabilities across major software ecosystems.

How outlets are covering it

Ars Technica and BleepingComputer both emphasize the active exploitation of CVE-2026-65400, citing NCSC warnings about Monero miner deployments. Ars Technica notes Apple's hedged language regarding the vulnerability's potential impact, while BleepingComputer highlights the specific technical fix involving state management mechanisms. 9to5Mac and MacRumors focus on the beta release of iOS 26.6.1 and macOS 26.6.2, noting the unusual beta process for minor security updates, but do not detail the specific exploit mechanics. The NCSC's warning is the primary source for the active exploitation claim, with all outlets agreeing on the need for immediate patching.

Why it matters

The active exploitation of CVE-2026-65400 poses a significant risk to macOS users, as it allows attackers to gain full control of systems without credentials. The deployment of Monero miners indicates that attackers are using the vulnerability for cryptocurrency mining, but the potential for more malicious activities, such as credential theft, exists. Users must prioritize patching to mitigate these risks.

What to watch

Apple is expected to release the final versions of macOS 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9 soon. Users should monitor for these updates and apply them promptly. In the interim, disabling screen sharing or using secure connections like VPNs is recommended. Security firms may continue to monitor for further exploitation attempts or variations of the attack.