Apple has recently addressed a significant security vulnerability in its macOS platform, releasing emergency updates to patch a critical flaw in the Screen Sharing feature. This flaw, identified as CVE-2026-65400, poses a serious risk, allowing unauthenticated remote attackers to execute arbitrary code and gain root-level access to files. Such a security breach can have dire implications, especially for systems where Screen Sharing functionality is exposed to the public internet.
On August 6, Apple rolled out updates for macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. These updates aim to fully remediate the issue and markedly improve users’ security. Administrators are advised to deploy these updates immediately to mitigate potential risks or, alternatively, disable the Screen Sharing feature altogether until updates can be applied.
The timing of this release is particularly notable, as it comes shortly after another Screen Sharing-related vulnerability, CVE-2026-43760, was disclosed in late July. Both vulnerabilities stem from weaknesses in Apple’s Remote Framebuffer (RFB)/VNC implementation. However, the exploitation requirements of these two flaws are vastly different. The previous vulnerability, CVE-2026-43760, required authenticated access; a user who connected via legacy VNC authentication could exploit the system to read or create filesystem objects with root privileges. In contrast, CVE-2026-65400 complicates the situation as it removes the need for any valid macOS account or VNC password, thereby broadening the attack surface for potential assailants.
Researcher Ryan Dowd has traced CVE-2026-65400 back to the Secure Remote Password (SRP) authentication handling within the screensharingd service. A faulty frame-length validation process allows the system to incorrectly maintain a stale successful state, misleading it into treating an unauthenticated connection as a legitimate one. This oversight culminates in a session that lacks the cryptographic protections that would typically accompany a proper SRP exchange. In light of this, various public proof-of-concept demonstrations have already shown how arbitrary file reads and writes could be carried out. Subsequent research has identified pathways leading to full remote code execution, including the ability to maintain persistence through mechanisms like LaunchDaemons or modified shell startup files.
The impact of such a vulnerability is compounded by the privileged helper processes involved with Screen Sharing, specifically SSFileCopySender and SSFileCopyReceiver. The SSFileCopySender process can execute with root privileges while carrying Apple’s private Full Disk Access entitlement, known as kTCCServiceSystemPolicyAllFiles. This particular entitlement allows for bypassing the macOS Transparency, Consent, and Control (TCC) protections, which could expose sensitive system and user data irrespective of the configured privacy settings.
It is critical to note that hardening configuration alone may not provide sufficient protection; removing approved users for Screen Sharing, disabling legacy VNC authentication, or changing VNC credentials will not prevent exploitation, as the vulnerability occurs before any authentication takes place.
Security teams are urged to be vigilant in monitoring for anomalous Endpoint Security Screen Sharing events. A successful malicious connection might manifest as an authentication_type set to SRP in the system logs, rather than the more secure RSA-SRP, with both session_username and authentication_username noted as "root," which is unusual since macOS typically disables the root account by default. Additionally, telemetry may indicate the SSFileCopySender launching from the screensharingd bundle with unusual arguments, often followed by atypical filesystem enumeration or access activity.
In response to this alarming vulnerability, organizations are advised to conduct a thorough inventory of all Mac endpoints. Priority should be given to hosts that are reachable via the internet, including any hosted Apple hardware and newly provisioned instances where remote management services may be activated by default. The urgency of updating to versions 26.6.1, 15.7.9, or 14.8.9 cannot be overstated.
If immediate patching is not feasible, organizations should consider disabling Screen Sharing and restricting remote administration services at the network boundary. Given that CVE-2026-65400 can be exploited before authentication occurs, comprehensive patching is crucial but not solely sufficient as a control mechanism across all supported macOS deployments.
This situation underscores the evolving nature of cybersecurity, especially concerning widely used platforms like macOS, and the critical importance of timely updates in maintaining secure systems.