What is known about this critical macOS vulnerability?
As reported by technology publication Ars Technica, a high-severity flaw designated CVE-2026-65400 is under active in-the-wild exploitation.
The flaw lies in the session state handling of Apple's Screen Sharing and Remote Management services. An attacker capable of routing network packets to a vulnerable Mac (primarily on port 5900) can bypass the authentication screen entirely without credentials and execute arbitrary commands with full administrative privileges (root).
atelier
Which devices and configurations are affected?
Security researchers and Apple have identified the main risk factors:
- Affected systems: Macs running macOS Sonoma, Sequoia, and related versions that have not installed the emergency patch.
- Prerequisite: Screen Sharing or Remote Management must be enabled in system sharing settings.
- Potential impact: Covert installation of malware, crypto-miners, spyware, or exfiltration of local documents.
Unpatched Mac vs. Patched & Secured Mac
Risk assessment based on your Mac's current software update status:
| Security Checkpoint | Updated & Secured Mac | Unpatched Mac |
|---|---|---|
| Screen Sharing | Strict cryptographic authentication enforced | Complete password bypass possible |
| System Privileges | User permissions strictly isolated and sandbox-protected | Full root-level administrative takeover |
| Network Exposure | Network ports shielded from automated exploit scanners | Highly vulnerable on open or public Wi-Fi networks |
| Malware Activity | Proactive blocking of unauthorized payload execution | Risk of undetected background spyware or mining tools |
4 emergency steps to secure your Mac immediately
Follow these recommended measures without delay:
- ✓Step 1: Open the Apple menu > System Settings > General > Software Update, and immediately install the available macOS patch.
- ✓Step 2: If you cannot update right away, navigate to System Settings > General > Sharing, and toggle off 'Screen Sharing' and 'Remote Management'.
- ✓Step 3: Avoid connecting to public or unencrypted Wi-Fi networks without an active, trusted VPN.
- ✓Step 4: If your Mac experiences unusual overheating or continuous fan noise, have it scanned in our workshop for background spyware.
How do I check if Screen Sharing is enabled on my Mac?
Click the Apple menu in the top-left corner, open 'System Settings', select 'General', and click 'Sharing'. Ensure the switches next to 'Screen Sharing' and 'Remote Management' are set to 'Off'.
Are iPhones and iPads vulnerable to this specific attack?
No. This vulnerability is specific to the macOS Screen Sharing daemon architecture. iOS and iPadOS devices do not include this remote control service.
MediaStreet Mac & Security Workshop
Need help updating or securing your Mac?
Our certified technicians can inspect your MacBook, iMac, or Mac mini, apply official Apple security patches, clean out malware, and optimize your machine's performance.
Book a workshop appointment