The Dutch government has issued an urgent security advisory after confirming that a high-severity macOS vulnerability, actively exploited in the wild, is being used to gain root-level access to fully patched Macs. The National Cyber Security Centrum (NCSC) reported that attackers are leveraging a flaw in the macOS screen sharing feature to compromise systems remotely, ultimately installing cryptocurrency miners on the victim’s hardware.
An Active Exploit Campaign Targeting macOS Screen Sharing
On Wednesday, the Netherlands National Cyber Security Centrum published a formal advisory warning about the active exploitation of a vulnerability tracked as CVE-2026-65400. The advisory states that the NCSC received credible notifications indicating abuse of this vulnerability on multiple systems where port 5900—the default port for Apple’s screen sharing and Virtual Network Computing (VNC) services—was exposed to the Internet. In every observed case, attackers successfully achieved root access and deployed a Monero cryptocurrency miner on the compromised machine.
The severity of this situation is amplified by the fact that the exploit does not require authentication. Apple’s own security documentation confirms that CVE-2026-65400 “may allow an attacker without credentials to gain access to a Mac.” This means that a vulnerable machine with screen sharing enabled and port 5900 accessible from the Internet can be fully compromised without the attacker needing to know a password, guess a username, or bypass any login mechanism.
This is not a theoretical proof-of-concept. The NCSC has confirmed that real-world attack campaigns are already harvesting vulnerable systems, silently installing Monero miners, and maintaining persistent root access on infected machines. While the immediate payload observed is a cryptocurrency miner—which typically only throttles system resources and increases power consumption—the implications are far more dangerous. An attacker with root access can install keyloggers, exfiltrate sensitive files, access saved passwords, and pivot to other systems on the local network.
The Technical Root: A Flaw in State Management
At the technical level, CVE-2026-65400 stems from a bug in the macOS screen sharing capability, a feature designed to allow a remote party to view the display and control the keyboard and mouse. The vulnerability originates from a failure in “state management”—the mechanism by which the operating system tracks preceding events, user interactions, variables, and the overall system state during a remote session.
When a remote connection is initiated to a Mac running the screen sharing service, the system must determine the proper session context. The flaw allows an attacker to manipulate or confuse this state-handling process, effectively bypassing the authentication handshake entirely. In simpler terms, the remote service is tricked into believing that a legitimate, authenticated user is already present, when in fact no credentials were ever provided.
Because the bug resides in the core logic of the screen sharing daemon, it affects all supported versions of macOS that include the feature. Apple issued patches for macOS Tahoe, Sequoia, and Sonoma concurrently, indicating that the bug spans multiple generations of the operating system—a sign that the underlying code path has been flawed for some time.
Why Port 5900 Is the Primary Vector
The attack vector relies on the screen sharing service being active and reachable. The NCSC advisory specifically notes that victims had port 5900 accessible from the Internet. This configuration is common among users who enable Screen Sharing in System Settings to remotely manage their Macs from the office, home, or while traveling. In many cases, users enable this feature without configuring a firewall exception properly, inadvertently leaving the port open to the entire Internet rather than restricting access to specific trusted IP addresses.
Attackers regularly scan large IP ranges for open port 5900 using automated tools. When they find a listening service, they attempt to exploit CVE-2026-65400 to gain immediate root access. The speed and scale of these scans mean that any Mac with an exposed port is likely to be probed within hours, if not minutes, of the vulnerability becoming public knowledge.
Notably, the vulnerability was disclosed at last week’s Black Hat security conference in Las Vegas. The details, published by security researcher Calif, were accompanied by a now-circulating video demonstrating the exploit in action. Once the technical details are presented at such a major conference, the window for unpatched systems collapses rapidly, as malicious actors immediately work to weaponize the information. The NCSC advisories and Apple’s patch release both happened concurrently, but the confirmed real-world exploitation indicates that attackers began scanning almost immediately after the Black Hat presentation.
How Does CVE-2026-65400 Work?
To understand how this vulnerability is exploited, one must look at the interaction between the remote connection daemon and the macOS state engine. During a typical connection request, the screen sharing service validates credentials, verifies the session type, and then transitions to an active state.
The exploit targets a race condition or logical error in the transition from the “unauthenticated” state to the “active” state. By sending specially crafted network packets during the initial handshake, an attacker can trigger an exception that causes the service to skip state validation altogether. The result is an unauthorized session established at the highest privilege level—root. The vulnerability bypasses all user-level checks and does not even require the local user account to be active or logged in.
What Is the Impact of Root Access?
Gaining root access on macOS is the equivalent of obtaining the crown jewels of the system. Root access means the attacker can modify system files, install kernel extensions, read the keychain where all saved passwords reside, disable security software, and create new administrator accounts for persistent access. In the observed attacks, the threat actors used this access to install a Monero miner, but they could just as easily deploy ransomware, spyware, or backdoors for future use.
Because the attacker has root privileges, the Monero miner is able to operate quietly in the background, hidden from normal user detection. It consumes CPU cycles to mine cryptocurrency, which generates financial profit for the attacker at the expense of the victim’s hardware. The victims’ machines can also be used to mine for the attacker’s pool without the user knowing until they notice lag, slow performance, or a higher electricity bill.
It is worth noting the contrast between the attack payload (a cryptocurrency miner) and the access level achieved (root). This low-sophistication payload combined with maximum privilege suggests the attackers are opportunistic operators who acquired the exploit from the Black Hat presentation and immediately integrated it into their mass-scanning infrastructure. The NCSC specifically recalled that in all confirmed incidents, a Monero miner was placed, indicating a consistent automated deployment script that follows the initial compromise.
Update Your Mac Immediately: A Patch for Every Major Version
Apple responded to the disclosure with a coordinated security update, assigning CVE-2026-65400 a severity rating of 7.1 out of 10. While that rating places it in the “high” category, the combination of remote exploitation, lack of required authentication, and confirmed active attacks makes this vulnerability one of the closest things to a “critical” issue that Apple has faced in recent years. Apple’s relatively conservative score may reflect the fact that exploitation requires the screen sharing service to be enabled and reachable, which is not the default configuration for most Macs.
The patches were released for:
- macOS Tahoe
- macOS Sequoia
- macOS Sonoma
Users running any of these operating systems version should apply the update immediately via System Settings > General > Software Update. If you have automatic updates enabled, you may already be protected. To verify that you have the patched version, check the “About This Mac” section and ensure your build number matches the latest version listed on Apple’s security support pages for your specific macOS generation.
Why Ignoring the Patch Is a Fragile Strategy
There is a tendency among Mac users to delay system updates due to concerns about workflow interruptions, compatibility issues with third-party plugins, or the fear of new bugs being introduced by the update itself. In this particular case, delaying the update is a significant security risk. The exploit is already being actively used in mass-scanning campaigns. A single evening of leaving your Mac exposed on port 5900 is sufficient for an automated scanner to find your machine and attempt the exploit.
Even if you do not use the screen sharing feature, if you have not manually disabled it and your router forwards port 5900 to your Mac’s local IP address, your system is potentially vulnerable. Attackers do not need to interact with your machine in any other way; a direct network connection to the vulnerable port is all that is required.
In general, the recommendation to disable Screen Sharing if you are not actively using it is a good practice. For users who rely on remote desktop access, the safest approach is to limit inbound connections to specific IP addresses or to tunnel the connection through a VPN or SSH. Exposing port 5900 directly to the public internet is an inherently risky configuration, regardless of whether the underlying service has a known vulnerability.
How You Can Determine if Your Screen Sharing Is Active
Many Mac users are unaware that their screen sharing service is running. It can be activated by third-party applications, remote management profiles, or by the user enabling it at some point and forgetting to turn it off.
To check if screen sharing is enabled on your Mac, navigate to System Settings (or System Preferences if you are on an older version of macOS), then click on General and select Sharing. If you see “Screen Sharing” listed as “On,” you have the service active. If you do not recognize that you enabled this feature, or if you no longer require it, turn it off immediately.
You can also check whether your machine is listening on port 5900. Open the Terminal application and run the following command: lsof -i :5900. If this command returns any output indicating that a service is listening on that port, it means the screen sharing service is active.
For users who are on a corporate or institutional network, an administrator might have enabled screen sharing for remote support. In such cases, check with your IT department to confirm that the appropriate security patches have been applied to all managed Macs, and that the remote management tooling is compliant with whatever access policies your organization has in place.
What the Black Hat Disclosure Signals for the Security Landscape
The disclosure of CVE-2026-65400 at the Black Hat conference marks a meaningful event in the ongoing cycle of vulnerability research and exploitation. The researcher who publicized the details, Calif, published a technical write-up titled “No Country for Old Passwords,” which accompanied the conference presentation. The choice to release the exploit details publicly signals a growing trend among security researchers to prioritize public awareness and vendor accountability over embargoed responsible disclosure windows, particularly when the vulnerability is severe and the vendor response is perceived as slow.
The ten-day gap between the public disclosure of the technical details and the confirmation of active criminal exploitation is practically nonexistent in cybersecurity terms. It underscores the speed with which vulnerability intelligence is operationalized by malicious actors. The NCSC’s decision to publicize the active exploitation details is highly unusual and demonstrates the severity of the situation; government agencies rarely issue alerts for ongoing attacks unless they believe the public risk of remaining silent outweighs the risk of informing the attackers that they have been discovered.
The Monero Connection and Why Miners Are Litmus Tests for Broader Attacks
Monero is a cryptocurrency designed with an emphasis on privacy and anonymity, making it a preferred choice for threat actors who mine coins on compromised hardware. Monero’s mining algorithm is resistant to ASIC, meaning it is efficiently mined on CPUs and GPUs found in consumer desktops and laptops. Unlike Bitcoin, which is no longer profitable to mine on standard hardware, Monero can provide a steady, if modest, stream of income for attackers who compromise large fleets of machines.
In this particular campaign, the use of Monero miners signal a few tactical realities:
- Attackers are highly likely to be opportunistic and automated, scanning the entire IPv4 address space for port 5900.
- The payload is meant to be long-term and stealthy, generating ongoing profit from the compromised system.
- The exploit chain is reliable enough that attackers are comfortable deploying the miner roughly instantaneously after gaining root.
For the victims, the presence of a miner is both the least and most harmful outcome. Least harmful because the attacker did not immediately wipe the disk, demand a ransom, or steal sensitive data. Most harmful because the miner is proof that the attacker achieved the highest level of system privilege, meaning they have demonstrated full control of the machine, and the avenue back in might remain open even after the miner is removed.
Why Apple’s “May” Wording Calls for a Cautious Approach
Apple’s advisory stated that CVE-2026-65400 “may allow an attacker without credentials to gain access to a Mac.” Security experts have noted that this cautious wording is typical of Apple’s vulnerability announcements, which tend to understate actual impact rather than overstate it. This language may be because the vulnerability’s exploitability is dependent on specific configuration settings, or because Apple has not fully replicated the exploit chain internally. However, it also serves a risk management purpose: by saying “may,” Apple reserves room to reassess the severity should further research reveal more widespread consequences.
Regardless of Apple’s reasoning for the wording, the empirical evidence from the NCSC’s advisory is clear. The Dutch government documented real cases in which attackers achieved root access on systems running unpatched macOS versions. Therefore, for the practical purposes of risk assessment, treat this as a 100% reliable remote code execution vulnerability when the screen sharing service is exposed.
It is also worth noting that this is a minimal risk for the average home user who has never enabled the screen sharing feature. The feature is off by default in macOS installations. Yet, it is common for users to enable it temporarily—to access a Mac from another room, to troubleshoot a family member’s computer, or during an initial setup—and then forget to turn it off. This “set it and forget it” mentality is precisely the behavior that puts these exposed systems on the internet.
Securing Your Mac Against Active Exploitation
If you have confirmed that your screen sharing service is disabled and port 5900 is not listening, you are effectively immune to this specific exploit regardless of whether your macOS system has been patched. If you cannot disable screen sharing because you rely on it for legitimate remote access, the patches released by Apple are mandatory and should be applied before you proceed with any other work.
Beyond applying the patch, several practical steps can drastically reduce your exposure to this class of vulnerability:
- Disable Screen Sharing when not in use. Turn it off after each session, even if you believe it is only accessible on your local network.
- Use a VPN for remote desktop. Instead of opening port 5900 to the internet, use Apple Remote Desktop or SSH through a VPN connection. This ensures that the service is never directly reachable by internet scan.
- Enable the Application Firewall. In System Settings > Network > Firewall, enable the built-in firewall and consider blocking all incoming connections except for explicitly allowed apps.
- Monitor for suspicious processes. Check Activity Monitor for processes with high CPU usage that you do not recognize. Monero miners are CPU-intensive and will typically cause fans to spin up or battery to drain quickly.
- Review login items and launch daemons. The Monero miner may persist through LaunchDaemons in /Library/LaunchDaemons or LaunchAgents in /Library/LaunchAgents. Check these folders for suspicious plist files that reference unknown executables.
For users who believe they have already been compromised—indicated by a slow system, unusually high CPU usage, or notice that unknown processes are running—power off the Mac immediately and take it to a reputable repair or forensics service to inspect the disk. Do not simply delete the miner process, as the attacker likely installed a persistence mechanism to restore it upon reboot.
The Implications for macOS Security Governance
This event also raises questions about the broader direction of macOS security. Apple has long held that its operating system is more secure than mainstream alternatives, citing the strict app sandboxing, the hardened runtime, and the tight hardware-software integration. However, the network-accessible attack surface of macOS is not immune to the same class of bugs that plague other operating systems. Remote code execution in a widely-used network service, even if not enabled by default, highlights the importance of defense-in-depth strategies at the enterprise level.
Enterprises that have allowed Macs to connect to the corporate network with screen sharing enabled should treat this as a severe event and prioritize patch deployment. Network administrators should also consider scanning their internal IP ranges for open port 5900 and identify any assets that are unexpectedly exposing the service. In an era of asset sprawl and remote work, having unmanaged Macs or test machines on the network that are exposed is more common than many organizations would like to admit.
The 7.1 severity rating may seem insufficient to some observers given that the exploit requires no authentication and yields root access. But in the context of the overall exploitability, the requirement that the screen sharing service be enabled and reachable—a non-default posture—meaningfully reduces the attack surface. The severity score reflects this condition, not an underestimation of the potential damage done when the condition is met.
As more macOS features move to network-accessible services, the security community will watch closely whether Apple begins to treat these features with increased hardening. It is unlikely that Apple will discontinue the screen sharing feature, as it is widely used in enterprise and education settings for remote management. Instead, the fix will be in the code review process, ensuring that the state machine governing authentication on network services is subjected to detailed audit when reviewed for future vulnerabilities.
In the meantime, users are reminded that the strongest security posture comes from a combination of updated software, minimal attack surface, and a healthy skepticism towards leaving any network service exposed to the internet. This vulnerability may be patched, but the underlying tension between convenience features and security trade-offs will continue to define the landscape for desktop operating systems for the foreseeable future.
