Bottom line: An actively exploited authentication flaw (CVE-2026-65400) in macOS Screen Sharing allows attackers to access devices without valid credentials, so organizations should patch affected systems immediately.
An authentication flaw in the macOS Screen Sharing feature allows attackers to connect to other people’s devices without valid credentials. The vulnerability is already being actively exploited, and affected systems should be patched immediately.
The vulnerability is an authentication flaw in macOS’s Screen Sharing feature. It allows attackers to establish a connection to another Mac device without having to present valid credentials. The flaw is tracked under the identifier CVE-2026-65400 and, according to reports, is already being actively exploited in the wild.
For CISOs at organizations with macOS fleets, this poses an immediate risk, as Screen Sharing is frequently used for remote support and remote maintenance, thereby opening up a direct access path to endpoint devices. Successful exploitation can give attackers full access to screen contents and potentially to the entire system, without having to go through a regular login process. Since the vulnerability is already being actively exploited, this represents a real and current threat scenario, not merely a theoretical risk.
Apple has released a patch, and prompt installation is strongly recommended. Security teams should check whether Screen Sharing is enabled in their environment, disable the service if it is not in use, and update affected macOS versions immediately. It is also advisable to review access logs for suspicious Screen Sharing connections in order to detect any compromises that may have already occurred.
Source: www.security-insider.de · Published August 20, 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.