Enterprise IT administrators and Apple macOS users are urged to audit remote access configurations following security disclosures from the Netherlands National Cyber Security Centre (NCSC). Threat actors are actively exploiting a critical authentication bypass vulnerability in macOS Screen Sharing to gain root access and deploy unauthorized Monero cryptocurrency miners on Internet-exposed Mac devices.
Deconstructing the CVE-2026-65400 Authentication Bypass
Tracked as CVE-2026-65400 with a CVSS severity rating of 9.8/10.0, the vulnerability affects the built-in Screen Sharing daemon operating over the VNC protocol on TCP port 5900.
Due to flawed state management routines during remote viewer connection handshakes, an unauthenticated network attacker can establish an active screen sharing session without supplying valid macOS account credentials. Once the session is established, the remote attacker can read system files as root, execute terminal commands, and plant background malware binaries.
Active In-The-Wild Exploitation and Monero Cryptojacking
Forensic telemetry reveals that automated botnets are actively scanning public IPv4 ranges for accessible port 5900 listeners. Upon identifying vulnerable Macs, the exploit script automatically drops and registers hidden Monero cryptominers, exhausting CPU resources and degrading system performance.
While Screen Sharing is disabled by default on macOS, remote workers, creative studios, and lab administrators frequently enable it for remote support, leaving devices vulnerable if perimeter firewalls fail to restrict access.
Remediation and Endpoint Hardening Guidance
To secure macOS fleets against remote exploitation and unauthorized cryptojacking, system administrators should implement immediate defensive measures:
- Deploy Apple Emergency Security Updates: Immediately apply Apple’s latest maintenance updates (macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9), which introduce corrected state management validation.
- Disable Unnecessary Remote Management: Navigate to System Settings > General > Sharing and disable “Screen Sharing” and “Remote Management” if not strictly needed.
- Block Inbound Port 5900 at Perimeters: Ensure corporate network firewalls and home routers strictly block inbound WAN traffic targeting TCP port 5900, requiring secure VPN or SSH tunneling for remote management.
- Audit Running Processes and CPU Spikes: Inspect Activity Monitor or enterprise EDR telemetry for persistent background processes consuming elevated CPU/GPU cycles.