CISA has added CVE‑2026‑65400 to its Known Exploited Vulnerabilities catalogue. The entry concerns Apple’s macOS and is titled “Apple macOS Improper Authentication Vulnerability”. In one sentence, the flaw lets an attacker on the same network authenticate to the Screen Sharing service without valid credentials.
The vulnerability is an improper authentication issue that can be exploited remotely over the network, allowing unauthorised remote access to a macOS system. It carries a CVSS v3.1 base score of 9.8, rating it as CRITICAL. Apple has released a patch that addresses the flaw.
Because CISA only adds vulnerabilities that are being actively exploited, this entry confirms that the flaw is already in use in the wild; no ransomware campaign has been linked to it at this time. Federal civilian executive branch (FCEB) agencies must apply the required mitigations by 2026‑08‑21, in line with CISA’s remediation due date for KEV entries.
CISA’s required action is: “Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.
Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.” While the directive binds FCEB agencies, all organisations should review their macOS assets for exposure and apply the vendor’s patch or follow the mitigations outlined above.
For full technical details, see the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-65400 and the CISA KEV catalogue.