Apple’s patch was released on August 6 and updates macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9.

Apple issued an emergency macOS security update to fix a critical flaw in the built-in Screen Sharing tool (CVE-2026-65400) that allowed remote attackers to bypass authentication and take full control of a Mac, including root access.

CISA has raised the vulnerability to Critical with a CVSS of 9.8 due to the exploit’s automation potential and the risk of full system compromise.

If users cannot apply the update immediately, a practical mitigation is to disable Screen Sharing in System Settings > General > Sharing to block port 5900 from internet access via router or firewall.

The issue arises from poor authentication state management in Screen Sharing, which uses VNC over TCP port 5900, leaving exposed systems vulnerable to remote control, file access, and code execution without user permission.

Government security agencies report that attackers have already exploited the bug to install hidden Monero cryptocurrency miners on affected Macs.