Skip to content
OriginalSign in

thezdi.comDustin Childs

Apple Patches 273 Flaws as Screen Sharing Bug Faces Active Attacks

Part of the CVE-2026-65400 story · since 7 Aug

Quiet for 6 weekslast report 16 Sep15 articles8 outlets
7 Aug · SecurityWeek first21 Sep6 OctNowThis article15th of 15
  • Fri 7 Aug, 09:40 UTC. SecurityWeek, first report. Microsoft, Apple issue patches for critical RCE and auth bypass. Cites a CVE in CISA KEV.
  • Fri 14 Aug, 18:45 UTC. Ars Technica, its first report on the story. Apple patches CVE-2026-65400 macOS flaw after crypto miner attacks. Cites a CVE in CISA KEV.
  • Sat 15 Aug, 09:46 UTC. Security Affairs, its first report on the story. Hackers exploit CVE-2026-65400 to mine Monero on macOS. Cites a CVE in CISA KEV.
  • Mon 17 Aug, 09:31 UTC. SecurityWeek. Apple fixes macOS Screen Sharing bug exploited for crypto mining. Cites a CVE in CISA KEV.
  • Mon 17 Aug, 11:51 UTC. Malwarebytes, its first report on the story. Update your Mac: Screen Sharing vulnerability exploited in the wild. Cites a CVE in CISA KEV.
  • Tue 18 Aug, 19:44 UTC. CISA, its first report on the story. CISA Adds CVE-2026-65400 to Known Exploited Vulnerabilities Catalogue. Cites a CVE in CISA KEV.
  • Wed 19 Aug, 00:03 UTC. CISA. CISA flags macOS Screen Sharing bug CVE-2026-65400 as exploited. Cites a CVE in CISA KEV.
  • Wed 19 Aug, 05:02 UTC. SecurityOnline, its first report on the story. CISA KEV Adds Four Exploited Flaws in SharePoint, vCenter. Cites a CVE in CISA KEV.
  • Wed 19 Aug, 08:01 UTC. Security Affairs. U.S. CISA adds Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft IKE flaws to its Known Exploited Vulnerabilities catalog. Cites a CVE in CISA KEV.
  • Wed 19 Aug, 11:01 UTC. SecurityWeek. CISA warns of active exploits in Microsoft, VMware, Apple bugs. Cites a CVE in CISA KEV.
  • Wed 19 Aug, 14:00 UTC. SecurityOnline. Google patches Android ContactsProvider2 SQLi high severity bug. Cites a CVE in CISA KEV.
  • Wed 19 Aug, 14:01 UTC. SecurityOnline. Urgent Patches Address Flaws in Microsoft, Apple, IBM Db2. Cites a CVE in CISA KEV.
  • Wed 19 Aug, 14:02 UTC. SecurityOnline. Telegram seeks .gram domain as critical zero day exploits surge. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 19:24 UTC. SANS ISC, its first report on the story. Apple Patches Record 261 Flaws Across New Operating Systems. Cites a CVE in CISA KEV.
  • Wed 16 Sep, 21:58 UTC. thezdi.com, its first report on the story. Apple Patches 273 Flaws as Screen Sharing Bug Faces Active Attacks. Cites a CVE in CISA KEV. This article, 15th of 15.

On 14 September 2026, Apple released security updates addressing 273 CVEs across macOS 27 (Golden Gate), macOS Sequoia 15.8, macOS Tahoe 26.7, iOS and iPadOS 27 and 26.7, visionOS 27, watchOS 27, tvOS 27, Safari 27 and Xcode 27. The update includes 134 vulnerabilities with scores and 139 still listed as “TBD”, as Apple does not publish CVSS ratings. The most urgent issue is CVE-2026-65400, a 9.8-critical Screen Sharing Server flaw that CISA has confirmed is being actively exploited.

It allows a network attacker to authenticate to Screen Sharing without valid credentials or user interaction. The fix was first issued on 6 August and is included in macOS 27 and macOS Tahoe 26.7.

CVE-2026-65414, a 9.8-critical Bluetooth vulnerability affecting all eight operating-system platforms, allows remote arbitrary code execution without privileges or user interaction; CISA marked it “automatable: yes” with “technical impact: total”, although exploitation was not confirmed.

Other notable issues include CVE-2026-65346, an 8.8-high ImageIO flaw where processing a malicious image can result in arbitrary code execution, and unscored CVE-2026-84607, which could let a sandboxed app execute code with kernel privileges. The report also highlights unscored CVE-2026-43790, involving remote kernel memory corruption, plus high-severity CUPS and autofs flaws.

Users and organisations should apply the relevant Apple updates, prioritising systems exposed to Screen Sharing and devices handling untrusted images or Bluetooth connections.

How the story developed

All 15 articles
Quiet for 6 weekslast report 16 Sep15 articles8 outlets

15 articles from 8 outlets since 7 Aug. Quiet since 16 Sep. This was the 15th report, 41 days after the first.

Now7 Aug10121416182014 Sep17First reportSecurityWeek · 7 Aug, 09:40This article15th of 15 · day 40CISA alert18 Aug, 19:44 · official
  • Fri 7 Aug, 09:40 UTC. SecurityWeek, first report. Microsoft, Apple issue patches for critical RCE and auth bypass. Cites a CVE in CISA KEV.
  • Fri 14 Aug, 18:45 UTC. Ars Technica, its first report on the story. Apple patches CVE-2026-65400 macOS flaw after crypto miner attacks. Cites a CVE in CISA KEV.
  • Sat 15 Aug, 09:46 UTC. Security Affairs, its first report on the story. Hackers exploit CVE-2026-65400 to mine Monero on macOS. Cites a CVE in CISA KEV.
  • Mon 17 Aug, 09:31 UTC. SecurityWeek. Apple fixes macOS Screen Sharing bug exploited for crypto mining. Cites a CVE in CISA KEV.
  • Mon 17 Aug, 11:51 UTC. Malwarebytes, its first report on the story. Update your Mac: Screen Sharing vulnerability exploited in the wild. Cites a CVE in CISA KEV.
  • Tue 18 Aug, 19:44 UTC. CISA, its first report on the story. CISA Adds CVE-2026-65400 to Known Exploited Vulnerabilities Catalogue. Cites a CVE in CISA KEV.
  • Wed 19 Aug, 00:03 UTC. CISA. CISA flags macOS Screen Sharing bug CVE-2026-65400 as exploited. Cites a CVE in CISA KEV.
  • Wed 19 Aug, 05:02 UTC. SecurityOnline, its first report on the story. CISA KEV Adds Four Exploited Flaws in SharePoint, vCenter. Cites a CVE in CISA KEV.
  • Wed 19 Aug, 08:01 UTC. Security Affairs. U.S. CISA adds Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft IKE flaws to its Known Exploited Vulnerabilities catalog. Cites a CVE in CISA KEV.
  • Wed 19 Aug, 11:01 UTC. SecurityWeek. CISA warns of active exploits in Microsoft, VMware, Apple bugs. Cites a CVE in CISA KEV.
  • Wed 19 Aug, 14:00 UTC. SecurityOnline. Google patches Android ContactsProvider2 SQLi high severity bug. Cites a CVE in CISA KEV.
  • Wed 19 Aug, 14:01 UTC. SecurityOnline. Urgent Patches Address Flaws in Microsoft, Apple, IBM Db2. Cites a CVE in CISA KEV.
  • Wed 19 Aug, 14:02 UTC. SecurityOnline. Telegram seeks .gram domain as critical zero day exploits surge. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 19:24 UTC. SANS ISC, its first report on the story. Apple Patches Record 261 Flaws Across New Operating Systems. Cites a CVE in CISA KEV.
  • Wed 16 Sep, 21:58 UTC. thezdi.com, its first report on the story. Apple Patches 273 Flaws as Screen Sharing Bug Faces Active Attacks. Cites a CVE in CISA KEV. This article, 15th of 15.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 15 articles as a list
  1. Fri 7 AugDay 01
    1. Microsoft, Apple issue patches for critical RCE and auth bypass09:40 · SecurityWeek · First report · Exploited CVE · Known exploited CVE

  2. Quiet for 7 days

    Fri 14 AugDay 71
    1. Apple patches CVE-2026-65400 macOS flaw after crypto miner attacks18:45 · Ars Technica · Picked up again · Known exploited CVE
  3. Sat 15 AugDay 81
    1. Hackers exploit CVE-2026-65400 to mine Monero on macOS09:46 · Security Affairs · Known exploited CVE

  4. Quiet for 2 days

    Mon 17 AugDay 102
    1. Apple fixes macOS Screen Sharing bug exploited for crypto mining09:31 · SecurityWeek · Known exploited CVE
    2. Update your Mac: Screen Sharing vulnerability exploited in the wild11:51 · Malwarebytes · Known exploited CVE
  5. Tue 18 AugDay 111
    1. CISA Adds CVE-2026-65400 to Known Exploited Vulnerabilities Catalogue19:44 · CISA · official · CISA alert · Known exploited CVE
  6. Wed 19 AugDay 127
    1. CISA flags macOS Screen Sharing bug CVE-2026-65400 as exploited00:03 · CISA · official · Known exploited CVE
    2. CISA KEV Adds Four Exploited Flaws in SharePoint, vCenter05:02 · SecurityOnline · Known exploited CVE
    3. U.S. CISA adds Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft IKE flaws to its Known Exploited Vulnerabilities catalog08:01 · Security Affairs · Known exploited CVE
    Show 4 more from 19 Aug
    1. CISA warns of active exploits in Microsoft, VMware, Apple bugs11:01 · SecurityWeek · Known exploited CVE
    2. Google patches Android ContactsProvider2 SQLi high severity bug14:00 · SecurityOnline · Known exploited CVE
    3. Urgent Patches Address Flaws in Microsoft, Apple, IBM Db214:01 · SecurityOnline · Known exploited CVE
    4. Telegram seeks .gram domain as critical zero day exploits surge14:02 · SecurityOnline · Known exploited CVE

  7. Quiet for 4 weeks

    Mon 14 SepDay 381
    1. Apple Patches Record 261 Flaws Across New Operating Systems19:24 · SANS ISC · Picked up again · Known exploited CVE

  8. Quiet for 2 days

    Wed 16 SepDay 401
    1. Apple Patches 273 Flaws as Screen Sharing Bug Faces Active Attacks21:58 · thezdi.com · Picked up again · Known exploited CVE · This article, 15th of 15

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in