Latest Apple macOS vulnerability: CVE-2026-65400 #
Apple disclosed in three separate advisories that certain versions of macOS Screen Sharing are affected by an authentication bypass vulnerability, due to underlying state management issues. Successful exploitation allows a remote, unauthenticated attacker to bypass credential checks and gain unauthorized access to the system. The vulnerability has been designated CVE-2026-65400 and has been rated critical with a CVSS score of 9.8.
There is evidence that CVE-2026-65400 is being actively exploited in the wild, prompting its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on August 18, 2026.
The following versions are affected
- macOS Tahoe 26.x: Versions prior to 26.6.1
- macOS Sequoia 15.x: Versions prior to 15.7.9
- macOS Sonoma 14.x: Versions prior to 14.8.9
What is Apple macOS Screen Sharing? #
Apple macOS Screen Sharing is a built-in utility that allows users to remotely view and control another Mac over a local network or the Internet using the VNC protocol.
What is the impact? #
Successful exploitation of this vulnerability would allow a remote, unauthenticated attacker to bypass authentication mechanisms and gain full remote desktop control over the affected system without valid credentials.
Are any updates or workarounds available? #
Users are encouraged to update to the latest version as quickly as possible:
- macOS Tahoe 26.x: Upgrade to version 26.6.1 or later.
- macOS Sequoia 15.x: Upgrade to version 15.7.9 or later.
- macOS Sonoma 14.x: Upgrade to version 14.8.9 or later.
How to find potentially vulnerable systems with runZero #
From the Asset Inventory, use the following query to locate potentially impacted assets:
os:="Apple macOS%" AND port:5900 AND protocol:vnc
