Attackers Actively Exploiting Patched macOS Screen Sharing Vulnerability (CVE-2026-65400)

A recently patched security flaw in Apple macOS, tracked as CVE-2026-65400, is being actively exploited by hackers. The vulnerability allows attackers to bypass authentication, gain root access, and install a cryptominer via macOS Screen Sharing. Apple addressed the issue with updates to macOS Sequoia (15.7.9), Sonoma (14.8.9), and Tahoe (26.6.1). The Netherlands' National Cyber Security Centre (NCSC) raised the advisory's severity after proof-of-concept code went public and active attacks were reported on systems with port 5900 reachable from the internet. Users unable to patch immediately are advised to disable Screen Sharing.