An authentication issue was addressed with improved state management.

CVE-2026-65400 is a pre-authentication remote code execution vulnerability in macOS Screen Sharing (screensharingd). A flaw in the Secure Remote Password (SRP) authentication handler causes a stale success state to persist after a malformed frame-length validation, allowing an attacker to establish an authenticated session without any credentials at all — no macOS account, no VNC password. The resulting session inherits the privileges of SSFileCopySender, which runs as root with Apple's Full Disk Access entitlement (kTCCServiceSystemPolicyAllFiles), bypassing TCC protections entirely. Affected versions span the entire current macOS lineup: Tahoe < 26.6.1, Sequoia < 15.7.9, and Sonoma < 14.8.9.

Apple rated this HIGH 7.1 with a CVSS vector claiming PR:L (low privileges required) and I:L (low integrity impact). Both are factually wrong. The bug is pre-authentication — PR:N — and the resulting access is root-level arbitrary file read/write with demonstrated RCE via LaunchDaemon injection, making integrity impact I:H. A corrected vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) yields a base score of 9.8. The vendor's label actively misleads defenders into deprioritizing a pre-auth root RCE with public proof-of-concept code.

Why this verdict

• Vendor CVSS is wrong: The vector claims PR:L but the bug is pre-authentication — no credentials of any kind are required. The corrected vector is PR:N with I:H/A:H, yielding a base score of 9.8 vs the vendor's 7.1. This is not a matter of interpretation; the attacker sends zero credentials.
• Public PoC with root RCE: Proof-of-concept code demonstrating arbitrary file reads/writes exists publicly, and follow-on work has weaponized it to full persistent RCE via LaunchDaemon injection. The exploit is deterministic — no race conditions, no heap grooming, no ASLR bypass needed.
• Role multiplier — CI/CD build farms are supply-chain targets: MacStadium's default macOS images ship with Screen Sharing enabled. AWS EC2 Mac instances commonly enable it for management. These hosts hold code-signing keys, build artifacts, and CI secrets. Compromise of a single build host enables supply-chain poisoning across all downstream consumers. This is a supply-chain-scale blast radius, triggering the CRITICAL floor.
• TCC bypass amplifies impact: The exploit inherits Full Disk Access via SSFileCopySender's entitlement, bypassing macOS's primary user-consent security boundary. This means Keychain extraction, browser credential theft, and access to all protected directories — no user interaction or consent prompt.
• Zero friction post-reachability: Once port 5900 is reachable, the entire chain from initial contact to persistent root backdoor requires zero user interaction, zero valid credentials, and zero complex exploitation techniques. The attack is fully automatable.

Why not higher?

A 9.1 (rather than 9.8) acknowledges that Screen Sharing is off by default on macOS, meaning the vulnerability requires an explicit configuration change to become exploitable. On endpoints where Screen Sharing is never enabled, the attack surface simply does not exist. This default-off posture meaningfully reduces the fraction of the macOS installed base that is exposed, even though the exposed subset faces catastrophic consequences.

Why not lower?

Downgrading below CRITICAL would require ignoring three compounding factors: (1) the bug is genuinely pre-authentication with public PoC, (2) the vendor's own CVSS is provably miscored by 2.7 points, and (3) cloud-hosted Mac CI/CD infrastructure — a meaningful and growing segment — ships with Screen Sharing enabled by default, creating a supply-chain-scale blast radius that floors the verdict at CRITICAL regardless of the default-off posture on consumer Macs.

1. Disable Screen Sharing immediately on all hosts where it is not operationally required — This eliminates the attack surface entirely. Use MDM (Jamf, Kandji, Mosyle) to push a configuration profile that disables Screen Sharing fleet-wide. Deploy within the noisgate mitigation SLA of ≤ 3 days for CRITICAL findings. Command: sudo launchctl disable system/com.apple.screensharing
2. Block port 5900 at network boundaries and host firewalls — Prevent any external or cross-segment reachability to Screen Sharing listeners. Apply ACLs on firewalls and configure macOS Application Firewall or pf to drop inbound 5900. Even if Screen Sharing must remain on for IT workflows, restrict source IPs to a jump host.
3. Require VPN or SSH tunnel for all remote Mac management — Never expose port 5900 directly, even on internal networks. Route all Screen Sharing traffic through an authenticated VPN or SSH tunnel (ssh -L 5900:localhost:5900 user@host). This adds an authentication layer the vulnerability cannot bypass.
4. Deploy macOS patches (Tahoe 26.6.1 / Sequoia 15.7.9 / Sonoma 14.8.9) within 3 days — The patches are available now. Prioritize CI/CD build hosts, cloud-hosted Macs, and any system where Screen Sharing is enabled. Use MDM to enforce the update. This is the noisgate remediation SLA for CRITICAL — ≤ 90 days — but given the pre-auth RCE with public PoC, push for ≤ 3 days on exposed hosts.
5. Audit for compromise indicators — Search for: new plists in /Library/LaunchDaemons/, modifications to shell profiles (.zshrc, .bash_profile), screensharingd logs showing authentication_type: SRP (not RSA-SRP), and root-owned VNC sessions. Any host with Screen Sharing enabled since August 6 should be treated as potentially compromised.

Run this script on each macOS host you want to check. No special privileges required for the version check. Execute with: bash check_cve_2026_65400.sh. The script checks both the OS patch level and whether Screen Sharing is currently enabled.

#!/bin/bash
# check_cve_2026_65400.sh
# Checks macOS patch level for CVE-2026-65400 (Screen Sharing SRP bypass)
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

OS_VERSION=$(sw_vers -productVersion 2>/dev/null)
if [ -z "$OS_VERSION" ]; then
  echo "UNKNOWN — not a macOS system or sw_vers unavailable"
  exit 2
fi

MAJOR=$(echo "$OS_VERSION" | cut -d. -f1)
MINOR=$(echo "$OS_VERSION" | cut -d. -f2)
PATCH=$(echo "$OS_VERSION" | cut -d. -f3)
PATCH=${PATCH:-0}

# Check Screen Sharing status
SS_ENABLED="unknown"
if launchctl list com.apple.screensharing &>/dev/null; then
  SS_ENABLED="yes"
else
  SS_ENABLED="no"
fi

echo "macOS version: $OS_VERSION"
echo "Screen Sharing enabled: $SS_ENABLED"

VULNERABLE=0

# macOS Tahoe 26.x — fixed in 26.6.1
if [ "$MAJOR" -eq 26 ]; then
  if [ "$MINOR" -lt 6 ]; then
    VULNERABLE=1
  elif [ "$MINOR" -eq 6 ] && [ "$PATCH" -lt 1 ]; then
    VULNERABLE=1
  fi
# macOS Sequoia 15.x — fixed in 15.7.9
elif [ "$MAJOR" -eq 15 ]; then
  if [ "$MINOR" -lt 7 ]; then
    VULNERABLE=1
  elif [ "$MINOR" -eq 7 ] && [ "$PATCH" -lt 9 ]; then
    VULNERABLE=1
  fi
# macOS Sonoma 14.x — fixed in 14.8.9
elif [ "$MAJOR" -eq 14 ]; then
  if [ "$MINOR" -lt 8 ]; then
    VULNERABLE=1
  elif [ "$MINOR" -eq 8 ] && [ "$PATCH" -lt 9 ]; then
    VULNERABLE=1
  fi
# Older macOS versions — likely vulnerable but no patch available
elif [ "$MAJOR" -lt 14 ]; then
  echo "VULNERABLE — macOS $OS_VERSION is end-of-life and has no patch for CVE-2026-65400"
  if [ "$SS_ENABLED" = "yes" ]; then
    echo "** CRITICAL: Screen Sharing is ENABLED on an unpatched, EOL system **"
  fi
  exit 1
else
  echo "UNKNOWN — unexpected macOS version $OS_VERSION"
  exit 2
fi

if [ "$VULNERABLE" -eq 1 ]; then
  echo "VULNERABLE — macOS $OS_VERSION is affected by CVE-2026-65400"
  if [ "$SS_ENABLED" = "yes" ]; then
    echo "** CRITICAL: Screen Sharing is ENABLED — this host is actively exploitable **"
    echo "Immediate action: sudo launchctl disable system/com.apple.screensharing && sudo launchctl bootout system/com.apple.screensharing"
  else
    echo "Screen Sharing is disabled — attack surface is not exposed, but patch promptly"
  fi
  exit 1
else
  echo "PATCHED — macOS $OS_VERSION includes the fix for CVE-2026-65400"
  exit 0
fi

Sources

1. NVD — CVE-2026-65400
2. GBHackers — Critical macOS RCE Vulnerability
3. CyberPress — Critical macOS Screen Sharing Flaw
4. 9to5Mac — Apple Screen Sharing Vulnerability
5. iClarified — Apple Releases macOS Updates
6. MacObserver — Update Your Mac Now
7. CVE.org — CVE-2026-65400
8. SecurityWeek — Microsoft, Apple Release Fresh Security Updates