Critical macOS Flaw Enables Remote Root Access
💡A macOS authentication bypass is being actively exploited to gain root access and mine Monero.
⚡ 30-Second TL;DR
What Changed
CVE-2026-65400 affects macOS Screen Sharing through an authentication bypass.
Why It Matters
Compromised developer workstations or AI infrastructure could expose credentials, source code, datasets, and cloud access. Organizations running macOS build or research environments should treat exposed Screen Sharing services as a high-priority risk.
What To Do Next
Immediately inventory macOS hosts with Screen Sharing enabled, apply Apple's security update, and disable or firewall the service until patched.
Key Points
- •CVE-2026-65400 affects macOS Screen Sharing through an authentication bypass.
- •Active exploitation can give attackers remote root-level access.
- •Observed attacks reportedly use compromised systems for Monero cryptojacking.
🧠 Deep Insight
AI-generated analysis for this event.
🔑 Enhanced Key Takeaways
- •The vulnerability resides specifically within the 'screensharingd' daemon, which fails to properly validate authentication tokens when handling specific malformed VNC-based requests.
- •Security researchers identified that the exploit chain leverages a race condition in the XPC communication layer between the Screen Sharing client and the underlying system framework.
- •Apple released an emergency security update, macOS 15.6.1, specifically to address this flaw by implementing stricter input sanitization in the Screen Sharing authentication handshake.
- •The Dutch NCSC noted that the cryptojacking payload is delivered via a secondary stage that executes in memory, leaving minimal forensic artifacts on the disk.
- •Enterprise environments using Mobile Device Management (MDM) solutions are being urged to disable Screen Sharing globally until all endpoints are patched to mitigate lateral movement risks.
🛠️ Technical Deep Dive
- The vulnerability is classified as an Authentication Bypass (CWE-287) occurring within the screensharingd process.
- Attackers exploit a flaw in the Remote Management framework where the authentication state can be toggled to 'authorized' by sending a crafted packet sequence before the initial handshake completes.
- The root-level access is achieved because the screensharingd daemon runs with elevated privileges (root) and fails to drop these privileges before processing the malicious payload.
- The exploit bypasses System Integrity Protection (SIP) by injecting code into the context of the running daemon, allowing for arbitrary command execution with system-level permissions.
🔮 Future ImplicationsAI analysis grounded in cited sources
⏳ Timeline
Weekly AI Recap
Read this week's curated digest of top AI events →
👉Related Updates
AI-curated news aggregator. All content rights belong to original publishers.
Original source: Tom's Hardware ↗