Apple macOS Screen Sharing Flaw Exploited to Install Monero Miner on Exposed Macs

Introduction

A critical security flaw in Apple macOS is being actively exploited by attackers to install Monero cryptocurrency miners on internet-exposed Macs. The vulnerability, tracked as CVE-2026-65400, affects the Screen Sharing component and has a CVSS score of 9.8 (Critical).

According to the Netherlands National Cyber Security Centre (NCSC-NL), attackers are targeting Macs with Screen Sharing enabled and port 5900 accessible from the internet. Once compromised, systems are being used to mine Monero cryptocurrency — draining CPU power and electricity without the user's knowledge.

What Is CVE-2026-65400?

CVE-2026-65400 is a critical authentication bypass vulnerability in Apple macOS Screen Sharing. It allows an attacker already on the network to authenticate to the built-in remote desktop service without valid credentials.

Key details:

• CVSS Score: 9.8 (Critical)
• Affected Component: Screen Sharing (screensharingd)
• Attack Type: Authentication bypass
• Impact: Remote code execution, cryptocurrency mining
• Status: Actively exploited in the wild

Apple released an emergency update on August 6, 2026 to address the issue. The fix improved state management to enforce correct credential validation. The vulnerability affects:

• macOS Tahoe 26.6.1
• macOS Sequoia 15.7.9
• macOS Sonoma 14.8.9

How the Attack Works

Security researchers have identified two distinct pre-authentication vulnerabilities in the Screen Sharing daemon that make exploitation extremely easy:

• First Bug (CVE-2026-65400): A logic error where a length check returns a stale success code. The caller reads this as "authentication passed" and advances the state machine.
• Second Bug: A state machine desynchronization issue. An attacker needs to know a username (which is not a secret — macOS displays usernames on the login screen).

The exploitation process is remarkably simple:

• No heap manipulation
• No ASLR defeat
• No race conditions
• No crashes
• Simply send one or two packets in the right order
• Works every time on every unpatched Mac with Screen Sharing enabled

According to security researcher @osxreverser, there are approximately 40,000 open Screen Sharing hosts on the internet, with almost half located in the United States. Many are residential IPs, but there are also numerous targets in universities and businesses.

What Is a Monero Miner?

A Monero miner is a type of cryptocurrency mining software that uses your computer's CPU power to mine Monero (XMR) — a privacy-focused cryptocurrency.

Why attackers use Monero:

• Privacy: Monero transactions are difficult to trace
• CPU-friendly: Monero mining works well on CPUs (unlike Bitcoin which requires specialized hardware)
• Stealth: Mining can run in the background without users noticing

When attackers install a Monero miner on your Mac, they:

• Use your CPU power to mine cryptocurrency
• Earn money while you pay for electricity
• Slow down your computer and cause overheating
• Shorten your device's lifespan

Who Is at Risk?

You are at risk if you meet any of these conditions:

• Screen Sharing is enabled on your Mac
• Port 5900 is exposed to the internet (accessible from outside your network)
• You have not installed the latest macOS security updates
• Your Mac is not behind a firewall or VPN

Even if you don't have Screen Sharing enabled, it's worth checking your settings to ensure it's turned off.

Other Related macOS Flaws

Apple patched several other Screen Sharing vulnerabilities in the same update:

• CVE-2026-43779 (CVSS 9.8): A logic issue allowing apps to intercept network connections
• CVE-2026-43777 (CVSS 7.5): A denial-of-service (DoS) vulnerability
• CVE-2026-43760 (CVSS 8.6): An access issue allowing apps to access sensitive user data

How to Protect Your Mac

Follow these steps immediately:

• Update your Mac immediately. Go to System Settings → General → Software Update and install the latest version. Apple has released patches for macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9.
• Disable Screen Sharing if you don't need it. Go to System Settings → General → Sharing and toggle Screen Sharing off.
• If you need Screen Sharing, do not expose it to the internet. Use a VPN or SSH tunnel for remote access instead.
• Check your firewall settings. Ensure port 5900 is not open to the internet unless absolutely necessary.
• Monitor your CPU usage. If your Mac is running unusually slow or hot, it could be running a crypto miner.
• Run a malware scan. Use reputable security software to check for unauthorized miners.
• Limit remote access. Only enable Screen Sharing when you are actively using it.

Final Thoughts

The active exploitation of CVE-2026-65400 is a serious reminder that Macs are not immune to cyberattacks. Attackers are actively scanning the internet for vulnerable systems, and the ease of exploitation makes this a particularly dangerous threat.

Key takeaways:

• A critical Screen Sharing flaw (CVE-2026-65400) is being exploited to install Monero miners
• Attackers can bypass authentication with just a few packets — no password needed
• Approximately 40,000 Macs with Screen Sharing exposed to the internet are at risk
• Apple has released emergency patches — update immediately
• Disable Screen Sharing unless you specifically need it
• Never expose Screen Sharing directly to the internet without a VPN or SSH

If you need help securing your Macs or want to learn more about protecting your business from vulnerabilities like this, contact SystemLogicIT for a free security assessment.