macOS 26.6.1
Juli Clover (release notes, security, no enterprise, no developer, full installer, IPSW):
macOS Tahoe 26.6.1 fixes a vulnerability that could allow an attacker to authenticate to Screen Sharing without valid credentials.
See also: Adam Engst and Mr. Macintosh.
Previously:
Update (2026-08-14): Bill Toulas:
In an update to the initial advisory, the Dutch agency said it received a report indicating that the vulnerability is being exploited in the wild in attacks where port 5900 is exposed to the internet.
According to the NCSC, the attacker obtained root access to the system and deployed a Monero cryptocurrency miner.
Update (2026-08-20): Edovia (tweet, MacRumors):
The vulnerability, identified as CVE-2026-65400, could allow an attacker on the network to authenticate to Screen Sharing without valid credentials. Reports now indicate that the vulnerability has been actively exploited on Macs where Screen Sharing was accessible from the Internet.
[…]
[We] strongly recommend that all Screens users install the latest macOS updates as soon as possible.
[…]
For users who want to further restrict access to Screen Sharing, Screens can connect to a Mac through an SSH tunnel instead of exposing the Screen Sharing service directly.
