macOS Screen-Sharing Flaw Under Active Attack, Giving Hackers Root Access

Dutch cybersecurity authorities have confirmed ongoing exploitation of a significant macOS flaw that enables remote attackers to seize complete control of affected machines, in some cases deploying crypto-mining software once system access is obtained.

Active Attacks Targeting Exposed Systems#

The Netherlands National Cyber Security Centrum disclosed that the vulnerability has been actively weaponized against multiple computers where port 5900 remained open to the internet. In each documented case, the attackers successfully escalated privileges to root level and installed Monero cryptocurrency miners on the compromised systems.

The Technical Flaw#

Identified as CVE-2026-65400, the vulnerability resides in macOS's screen-sharing feature—a capability that normally allows authorized remote users to view displays and command keyboards and mice. The underlying issue stems from improper management of system state, the internal tracking mechanism responsible for monitoring prior events, user actions, variables, and other operational conditions. Apple released patches for macOS versions Tahoe, Sequoia, and Sonoma last week, and assigned the flaw a severity score of 7.1 out of 10.

Why This Matters#

The flaw stands out because attackers can exploit it without possessing valid user credentials. Though Apple's advisory used cautious language—stating the vulnerability "may" enable unauthorized access—this type of qualification remains standard practice across the technology industry. A proof-of-concept demonstration was shared publicly, and technical details emerged at the Black Hat security conference last week.

Users with screen sharing enabled and port 5900 exposed to the internet face particular risk and should prioritize applying the available patches immediately.