macOS Screen Sharing CVE-2026-65400: Authentication Bypass Leads to Root Access and Monero Miner Installation

1. Basic Information

• Severity: Critical
• Title: Hackers exploit macOS Screen Sharing flaw to deploy Monero miner
• Source: BleepingComputer
• Published Date: 2026-08-14
• Updated Date: N/A
• Original Article: Original Article
• Related Sources: Apple Security, NCSC-NL NCSC-2026-0280
• Malware: Monero cryptocurrency miner (Name and hash unknown)
• Threat Groups: N/A
• CVEs: CVE-2026-65400
• Products: macOS Screen Sharing, macOS Tahoe before 26.6.1, macOS Sequoia before 15.7.9, macOS Sonoma before 14.8.9, VNC/TCP 5900

2. Summary

An authentication state management flaw in macOS Screen Sharing exposed to the internet allows attackers to authenticate without valid credentials. Multiple cases have reached root access and the deployment of a Monero miner.

3. Attack Flow

Attack Chain Confirmed in Public Reports

1. The attacker connects to macOS Screen Sharing from the internet via TCP/5900.
2. The attacker exploits the authentication state flaw in CVE-2026-65400 to establish a session without valid credentials.
3. The attacker gains the ability to launch applications, access files, and change security settings via remote desktop.
4. In multiple cases reported to NCSC-NL, the attacker obtains root access.
5. A Monero cryptocurrency miner is installed.

4. Attacker Position and Execution Location

• The attacker reaches the public VNC/TCP 5900 service from the internet.
• Initial execution occurs within the macOS Screen Sharing service and the remote GUI session.
• Specific steps for root acquisition, the presence of other vulnerabilities, and miner persistence methods are not publicly disclosed.

5. Visibility for Victims and Administrators

• No user interaction is required. Screen sharing indicators or cursor/GUI changes may sometimes be visible.
• Administrators may observe TCP/5900 connections from external IPs, screen sharing sessions not tied to regular accounts, root processes, and miners/high CPU usage.
• Because valid accounts are not used, a password reset alone cannot contain the vulnerability.

6. Success and Failure Conditions

Success Conditions

• Screen Sharing is enabled on the affected macOS.
• TCP/5900 is reachable by the attacker.
• Patches are not applied.
• There are no controls to block execution or settings changes after a remote session.

Failure Conditions

• Update to Tahoe 26.6.1, Sequoia 15.7.9, Sonoma 14.8.9, or later.
• Disable unnecessary Screen Sharing.
• Block TCP/5900 from the internet and restrict it to VPN or management networks.
• Early detection and isolation of remote sessions, root processes, and miner/pool communications.

7. What Happens on Success

• Remote desktop access without authentication.
• File access, application launching, and security setting changes.
• Root access and Monero miner installation in actual reported incidents.
• Root acquisition paths, persistence, data theft, and lateral movement are not confirmed in public data.

8. Observable Logs

Email

• None related.

Proxy / SWG / DNS

• DNS queries and traffic to miner pools/Stratum endpoints (Specific IOCs not public).
• Connections to unknown download sources.

Endpoint / EDR

• Screen Sharing related processes and sessions.
• Unknown binaries running as root.
• Increased CPU/GPU usage.
• Miner-specific processes and command lines.
• LaunchDaemons (useful if identified, though specific persistence methods are not public).

Identity / IdP

• Screen Sharing authentication success not tied to a valid account.
• Inconsistencies in local login/authorization events.
• Sessions persisting after password changes.

SaaS / Cloud

• None related. MDM device versions and compliance can be used to check patch status.

Network

• TCP/5900 connections from the internet.
• Connections from the same source to multiple Macs.
• Outbound miner pool traffic following a session.

9. Attack Success Determination

Contact Only

• TCP/5900 scan or SYN packets only.

User Interaction

• Not required.

Initial Execution

• Screen Sharing session established and GUI/application manipulation observed.

Malware or Successful Authentication

• Authentication success without valid credentials, root access, or miner process.

Data Theft / Session Compromise

• Remote desktop sessions can be confirmed, but data exfiltration is not confirmed in public reports.

Subsequent Compromise Confirmation

• Confirmation of miner installation, security setting changes, additional payloads, or lateral movement.

10. Investigation Playbook

Trigger

• Internet-exposed TCP/5900.
• macOS versions matching NCSC advisory.
• Unknown Screen Sharing sessions.
• Root miner or high CPU usage.

Initial Verification

• Confirm macOS version, Screen Sharing settings, exposure path, initial source IP, and timestamp.
• Cross-reference account/session logs with valid login activity.

Endpoint

• Preserve process trees, launchd entries, file creations, quarantine/xattr attributes, unified logs, and network sockets.
• Identify the start time of root access and the miner binary/hash.

Authentication and Cloud

• Check local account/password change history, MDM commands, and SaaS sessions.
• Note that initial access does not require a valid account.

Subsequent Actions

• Hunt for downloads, persistence, pool communication, SSH/remote services, file access, and lateral movement.

Containment

• Block TCP/5900, disable Screen Sharing, isolate the host, apply patches, and terminate all sessions.
• Consider credential rotation and system rebuilding if root compromise is confirmed.

Determination Categories

• Scanned
• Unauthenticated Screen Session Confirmed
• Root Access Confirmed
• Miner Installed
• Additional Compromise Confirmed

11. Defense and Detection Ideas

Single Event

• Internet to TCP/5900 connection.
• Screen Sharing success without a matching valid account.
• Unknown miner running as root.
• Sustained high CPU load.

Time-Series Correlation

• Port 5900 connection → Screen Sharing session → GUI/process launch → Root process → Miner download → Pool communication.

Threat Hunting Perspective

• Inventory of Macs exposed to the internet.
• OS versions older than August 6.
• Screen Sharing and remote management unified logs.
• New binaries running as root.
• Stratum or known miner pool connections.

Log Gaps

• Screen Sharing authentication results.
• Remote GUI actions.
• Root acquisition path.
• File access.
• Miner IOCs.
• Launchd modifications.

Priority Actions

• Update operating systems.
• Block port 5900 from the internet.
• Set Screen Sharing to default-off.
• Segregate management planes.
• Monitor root processes and egress traffic.

12. Facts / Inference / Hypothesis

Facts

• Apple patched CVE-2026-65400 on August 6, 2026.
• The root cause is a state management flaw in Screen Sharing authentication, allowing network attackers to authenticate without valid credentials.
• NCSC-NL reported active abuse on multiple systems with port 5900 exposed to the internet.
• Root access and Monero miner deployment were confirmed in all reported cases.
• Methods for root acquisition, miner names/hashes, and persistence are not publicly disclosed.

Inference

• Macs with TCP/5900 directly exposed to the internet should be prioritized for inventory and patching.
• Confirming a compromise requires correlating post-session root processes and egress traffic, not just authentication logs.

Hypothesis

• Payloads other than miners could potentially be deployed, though this has not been confirmed in public reports.

13. MITRE ATT&CK Mapping

• T1190 Exploit Public-Facing Application — Confidence: High
• T1133 External Remote Services — Confidence: High
• T1496 Resource Hijacking — Confidence: High
• T1105 Ingress Tool Transfer — Confidence: Medium (Miner download path is not public)
• T1543.004 Launch Daemon — Confidence: Low (Investigation perspective; persistence methods unconfirmed)

14. Unknowns and Additional Investigation

• Specific attack chain for acquiring root access.
• Miner binaries/hashes, download URLs, and pool/C2 servers.
• Presence of persistence, defense evasion, lateral movement, or data access.
• Number of victim systems, geographic locations, and threat actors.
• Consistency between public PoCs and actual attack payloads.

15. Impact on SOCs and General Enterprises

Development, design, and research environments often utilize remote Mac support. Organizations should not lower priority based solely on a CVSS score of 7.1. Instead, they should execute emergency patching and retrospective hunting based on exposed port 5900, active exploitation, and root miner risks.

16. Summary by Target Audience

• For SOCs: Evaluate port 5900 contact, unauthenticated sessions, root access, and miners as separate stages, and explicitly note that the root acquisition path remains unknown.
• For Administrators: Update to the three patched versions, disable unnecessary Screen Sharing, and never expose port 5900 to the internet.
• For Users: Report unexpected screen activity, sudden high system load, unusual heat generation, or fan noise on Macs to administrators.