High 7.1
KEV-listed
CVE-2026-65400
macOS Screen Sharing vulnerability actively exploited for crypto mining
Vendor / product: macOS Screen Sharing
Event date: 2026-08-11
Public PoC: Yes
First tracked by RiskWire: 2026-08-14
CISA KEV catalog
Added to KEV
Federal remediation due
2026-08-21 (30 days overdue)
Ransomware campaign use
Unknown
CISA description
Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Sources & citations (72)
- Critical macOS Screen Sharing Vulnerability Under Active Exploitation world-today-news.com · 2026-08-14
- Vulnerability giving attackers full control of Macs is under active exploitation arstechnica.com · 2026-08-14
- Hackers exploit macOS Screen Sharing flaw to deploy Monero miner bleepingcomputer.com · 2026-08-14
- MacOS screen sharing vulnerability actively exploited for crypto mining scmagazine.com · 2026-08-14
- macOS Screen Sharing Flaw Exploited to Deploy Monero Miners securityaffairs.com · 2026-08-15
- Apple macOS Screen Sharing Flaw Exploited on Internet-Exposed Macs to Install Monero Miner thehackernews.com · 2026-08-15
- Apple patches actively exploited macOS Screen Sharing authentication flaw mlq.ai · 2026-08-16
- Hackers exploited macOS Screen Sharing flaw to install Monero miners, Dutch cyber agency says theblock.co · 2026-08-16
- 苹果macOS高危漏洞已被利用，可获取Root权限 163.com · 2026-08-17
- Apple patches macOS screen sharing vulnerability used to deploy Monero mining malware kucoin.com · 2026-08-16
- Critical macOS Screen Sharing flaw gives attackers remote root access — CISA bumps bug to 9.8 severity following active Monero cryptojacking attacks tomshardware.com · 2026-08-16
- Apple patches macOS flaw exploited to mine Monero crypto.news · 2026-08-17
- macOS Screen Sharing Vulnerability Exploited for Crypto Mining en.cryptonomist.ch · 2026-08-16
- Hackers exploit macOS screen sharing vulnerability to mine Monero cryptonews.net · 2026-08-16
- Apple Patches macOS Flaw Used to Mine Monero on Hijacked Macs coincentral.com · 2026-08-17
- Critical macOS Security Flaw Exploited for Monero Cryptocurrency Mining blockonomi.com · 2026-08-17
- CoinStats - Hackers exploited macOS Screen Sharing flaw t... ground.news · 2026-08-16
- macOS Screen Sharing: CISA stuft Sicherheitslücke auf 9,8 hoch borncity.com · 2026-08-16
- macOS高危漏洞CVE-2026-65400遭野利用，苹果紧急推送修复更新 news.zol.com.cn · 2026-08-17
- 苹果macOS屏幕共享高危漏洞已遭黑客利用，攻击者可远程获取Root权限 tech.ifeng.com · 2026-08-17
+52 more sources
References
See CVE-2026-65400 in context
RiskWire tracks every exploited CVE this week, cross-referenced against CISA KEV with federal remediation deadlines. Filtered to your vendor stack.
Book a 20-min demo →