Apple users are strongly advised to update their macOS systems immediately following confirmation that a critical vulnerability in the Screen Sharing feature has been actively exploited. The bug, which allows attackers to gain unauthorized access and control over a user’s computer, was initially patched by Apple as a precautionary measure. However, recent reports indicate it is now being used maliciously in real-world attacks.
Critical Screen Sharing Vulnerability Now Actively Exploited
A significant security flaw within Apple’s built-in Screen Sharing application has transitioned from a theoretical threat to an active exploit. This vulnerability, identified by the identifier CVE-2026-65400, permits attackers to view a user’s screen, access and open files, and essentially perform any action as if they had direct physical access to the machine. This level of access is extremely dangerous, potentially compromising sensitive data and system integrity.
The issue was first brought to light when Apple released security updates for its macOS operating systems. At that time, the vulnerability had not been observed in the wild, leading Apple to issue the patches as a proactive security measure. However, a recent report has confirmed that the bug is no longer theoretical. It has been observed being actively used to compromise systems.
Real-World Exploitation Confirmed in the Netherlands
According to a report detailed by Ars Technica, the critical Screen Sharing bug has been found to be actively causing harm in the Netherlands. Officials from the Netherlands National Cyber Security Centrum (NCSC) have issued a formal warning regarding the exploitation of this vulnerability. The NCSC reported receiving multiple notifications of the flaw being used on various systems.
In all confirmed instances of exploitation, attackers successfully gained root access to the affected computers. Following this unauthorized access, they proceeded to install cryptocurrency mining software. This type of malware can significantly degrade system performance and is often used to generate illicit profits for the attackers by leveraging the victim’s computing resources.
Technical Details of the Exploit
Security researchers, including those who reverse-engineered Apple’s patch for macOS version 26.6.1, have provided insights into the exploit’s mechanics. A proof-of-concept (PoC) demonstrating the critical vulnerability in Apple’s macOS Screen Sharing was shared, highlighting its severity. The core issue lies in the Screen Sharing functionality itself. If enabled, the vulnerability allows any attacker present on the same network to exploit the bug. This enables them to log into any user account on the targeted system without needing to know the account’s password, effectively bypassing standard authentication measures.
The exploit’s success hinges on the Screen Sharing service being accessible. Specifically, the vulnerability is actively exploited when the standard port for Screen Sharing, port 5900, is exposed to the internet. This means that systems configured to allow external access to this port are particularly at risk.
Affected macOS Versions and Recommended Actions
The security flaw impacts several recent versions of Apple’s operating system, including macOS Tahoe, Sequoia, and Sonoma. Apple has already released updated versions for all three of these operating system families to address the vulnerability. The initial recommendation to update was based on the potential risk, but with confirmed exploitation, it has become an absolute necessity for all users of affected systems.
Immediate Steps for Users
Given the active exploitation, users should take immediate steps to secure their systems:
- Update macOS: The most crucial step is to install the latest security updates provided by Apple for your specific macOS version (Tahoe, Sequoia, or Sonoma). This will patch the vulnerability.
- Disable Screen Sharing (if not needed): For users who do not require the Screen Sharing feature, disabling it entirely provides an additional layer of security. This option can be found within the System Settings menu.
- Network Security: Security experts emphasize the importance of network configuration. Ensure that port 5900 is not exposed to the internet unless absolutely necessary and properly secured. Closing this port can prevent network attackers from reaching the vulnerable service.
Broader Context: Screen Sharing Security Concerns
This incident highlights the ongoing challenges in securing remote access tools. It is worth noting that this is not the only significant screen-sharing bug to emerge recently. Zoom, a widely used video conferencing and collaboration platform, also experienced a similar security issue that required a patch. These events underscore the importance of vigilance and prompt software updates for all applications that facilitate remote access or screen sharing.
By taking the recommended actions, Apple users can significantly mitigate the risk posed by this critical vulnerability and protect their systems from unauthorized access and potential compromise.
