Skip to content
Sign in
CVE-2026-654009.8Critical

CVE-2026-65400: Apple macOS Improper Authentication Vulnerability

Apple · macOS

Vendor fix available · Affected: Apple macOS · Exploitation: in CISA KEV since 18 Aug

ExploitationIn CISA KEV

  1. In CISA KEVCISA KEV catalogue18 Aug
  2. Exploited (reported): not seen
  3. Scanning observed: not seen
  4. Proof of concept public: not seen
  5. Not established: not seen
1.7%probability of exploitation in the next 30 days
77th percentile
050100

Higher than 77% of scored CVEs

9.8CriticalCVSS
LowCrit.

Federal deadline

CISA KEV · added 18 Aug · catalogue entry

Passed 75 days ago

DescriptionNVD

An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, macOS Tahoe 26.7. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.

What changed

  1. CISA added it to the KEV catalogue CISA

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Coverage15 articles · 8 outlets

One row per outlet, in order of first report. First in our coverage: SecurityWeek, 7 Aug.

Full timeline
Quiet for 7 weekslast report 16 Sep15 articles8 outlets
7 Aug · SecurityWeek first24 Sep10 OctNow
  • Fri 7 Aug, 09:40 UTC. SecurityWeek, first report. Microsoft, Apple issue patches for critical RCE and auth bypass. Cites a CVE in CISA KEV.
  • Fri 14 Aug, 18:45 UTC. Ars Technica, its first report on the story. Apple patches CVE-2026-65400 macOS flaw after crypto miner attacks. Cites a CVE in CISA KEV.
  • Sat 15 Aug, 09:46 UTC. Security Affairs, its first report on the story. Hackers exploit CVE-2026-65400 to mine Monero on macOS. Cites a CVE in CISA KEV.
  • Mon 17 Aug, 09:31 UTC. SecurityWeek. Apple fixes macOS Screen Sharing bug exploited for crypto mining. Cites a CVE in CISA KEV.
  • Mon 17 Aug, 11:51 UTC. Malwarebytes, its first report on the story. Update your Mac: Screen Sharing vulnerability exploited in the wild. Cites a CVE in CISA KEV.
  • Tue 18 Aug, 19:44 UTC. CISA, its first report on the story. CISA Adds CVE-2026-65400 to Known Exploited Vulnerabilities Catalogue. Cites a CVE in CISA KEV.
  • Wed 19 Aug, 00:03 UTC. CISA. CISA flags macOS Screen Sharing bug CVE-2026-65400 as exploited. Cites a CVE in CISA KEV.
  • Wed 19 Aug, 05:02 UTC. SecurityOnline, its first report on the story. CISA KEV Adds Four Exploited Flaws in SharePoint, vCenter. Cites a CVE in CISA KEV.
  • Wed 19 Aug, 08:01 UTC. Security Affairs. U.S. CISA adds Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft IKE flaws to its Known Exploited Vulnerabilities catalog. Cites a CVE in CISA KEV.
  • Wed 19 Aug, 11:01 UTC. SecurityWeek. CISA warns of active exploits in Microsoft, VMware, Apple bugs. Cites a CVE in CISA KEV.
  • Wed 19 Aug, 14:00 UTC. SecurityOnline. Google patches Android ContactsProvider2 SQLi high severity bug. Cites a CVE in CISA KEV.
  • Wed 19 Aug, 14:01 UTC. SecurityOnline. Urgent Patches Address Flaws in Microsoft, Apple, IBM Db2. Cites a CVE in CISA KEV.
  • Wed 19 Aug, 14:02 UTC. SecurityOnline. Telegram seeks .gram domain as critical zero day exploits surge. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 19:24 UTC. SANS ISC, its first report on the story. Apple Patches Record 261 Flaws Across New Operating Systems. Cites a CVE in CISA KEV.
  • Wed 16 Sep, 21:58 UTC. thezdi.com, its first report on the story. Apple Patches 273 Flaws as Screen Sharing Bug Faces Active Attacks. Cites a CVE in CISA KEV.
All coveragerunning totalAdded to CISA KEV · 18 Aug15SecurityWeek3Ars Technica1Security Af…2Malwarebytes1CISA2SecurityOnl…4SANS ISC1thezdi.com18 Aug7 Sep7 OctNow
  • First report
  • Article
  • Official notice
  • Running total

Added to CISA KEV

Show as table
15 articles about CVE-2026-65400 from 8 outlets
Published (UTC)OutletHeadline
7 Aug 09:40SecurityWeekMicrosoft, Apple issue patches for critical RCE and auth bypass
14 Aug 18:45Ars TechnicaApple patches CVE-2026-65400 macOS flaw after crypto miner attacks
15 Aug 09:46Security AffairsHackers exploit CVE-2026-65400 to mine Monero on macOS
17 Aug 09:31SecurityWeekApple fixes macOS Screen Sharing bug exploited for crypto mining
17 Aug 11:51MalwarebytesUpdate your Mac: Screen Sharing vulnerability exploited in the wild
18 Aug 19:44CISACISA Adds CVE-2026-65400 to Known Exploited Vulnerabilities Catalogue
19 Aug 00:03CISACISA flags macOS Screen Sharing bug CVE-2026-65400 as exploited
19 Aug 05:02SecurityOnlineCISA KEV Adds Four Exploited Flaws in SharePoint, vCenter
19 Aug 08:01Security AffairsU.S. CISA adds Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft IKE flaws to its Known Exploited Vulnerabilities catalog
19 Aug 11:01SecurityWeekCISA warns of active exploits in Microsoft, VMware, Apple bugs
19 Aug 14:00SecurityOnlineGoogle patches Android ContactsProvider2 SQLi high severity bug
19 Aug 14:01SecurityOnlineUrgent Patches Address Flaws in Microsoft, Apple, IBM Db2
19 Aug 14:02SecurityOnlineTelegram seeks .gram domain as critical zero day exploits surge
14 Sep 19:24SANS ISCApple Patches Record 261 Flaws Across New Operating Systems
16 Sep 21:58thezdi.comApple Patches 273 Flaws as Screen Sharing Bug Faces Active Attacks
  1. Apple Patches 273 Flaws as Screen Sharing Bug Faces Active Attacks
    thezdi.com
  2. Apple Patches Record 261 Flaws Across New Operating Systems
    SANS ISC · mentions it in passing
  3. Telegram seeks .gram domain as critical zero day exploits surge
    SecurityOnline · mentions it in passing
  4. Urgent Patches Address Flaws in Microsoft, Apple, IBM Db2
    SecurityOnline · mentions it in passing
  5. Google patches Android ContactsProvider2 SQLi high severity bug
    SecurityOnline · mentions it in passing
  6. CISA warns of active exploits in Microsoft, VMware, Apple bugs
    SecurityWeek · mentions it in passing
  7. U.S. CISA adds Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft IKE flaws to its Known Exploited Vulnerabilities catalog
    Security Affairs · mentions it in passing
  8. CISA KEV Adds Four Exploited Flaws in SharePoint, vCenter
    SecurityOnline · mentions it in passing
Show 7 more

New articles also arrive in the RSS feed.

References

CyberSIXTSignal over noise
Updated AboutDevelopersSign in