Attackers have begun exploiting a critical vulnerability in macOS's built-in Screen Sharing feature to gain access to Mac computers without any valid credentials whatsoever. In several confirmed cases, attackers who established this unauthorized connection subsequently obtained root privileges and installed a Monero cryptocurrency miner. An Authentication Bypass in Screen Sharing The vulnerability, tracked as CVE-2026-65400, affects the Screen Sharing feature. According to…

Malicious actors currently exploit a critical vulnerability in macOS. Specifically, attackers target computers with the "Screen Sharing" feature enabled and exposed. They successfully bypass credential verification and instantly gain root privileges. Subsequently, they install a Monero cryptominer. In all confirmed cases, the victims had exposed port 5900 directly to the internet. Vulnerability Report: CVE-2026-65400 This critical vulnerability received the identifier CVE-2026-65400.