Credential-Free Authentication Bypass in macOS Screen Sharing (CVE-2026-65400)
CISA added this flaw to KEV today with a 2026-08-21 deadline after the Dutch NCSC confirmed active exploitation and public exploits appeared, so any Mac with Screen Sharing enabled and reachable over the network can be taken over without credentials this week.
An improper-authentication flaw in macOS Screen Sharing lets an attacker on the network authenticate to a Mac's Screen Sharing service without any valid credentials, resulting in full interactive control of the machine. Public exploit code is available.
Affected: macOS Sonoma < 14.8.9; macOS Sequoia < 15.7.9; macOS Tahoe < 26.6.1
How to Test
Check the macOS version via `sw_vers -productVersion`; anything below 14.8.9, 15.7.9, or 26.6.1 is vulnerable. Determine exposure with `sudo lsof -iTCP:5900 -sTCP:LISTEN` or by checking System Settings > General > Sharing for Screen Sharing/Remote Management enabled, and review screensharingd entries in the unified log (`log show --predicate 'process == "screensharingd"'`) for successful sessions from unknown source IPs.
How to Patch
Update to macOS Sonoma 14.8.9, Sequoia 15.7.9, or Tahoe 26.6.1 (released August 6, 2026) via Software Update or MDM. Until patched, disable Screen Sharing and Remote Management on all Macs where they are not essential, and block inbound TCP 5900 at network and host firewalls from untrusted networks.