Project
Built-in macOS remote desktop feature that lets users view and control a Mac remotely, implemented via the VNC protocol over TCP port 5900.
Apple's emergency macOS update on August 6 fixed a Screen Sharing flaw that calif.io turned into a working exploit about four hours later. The flaw let anyone on the network sign in without a password, and the service answering those connections runs as root.
Reality
The Dutch NCSC says CVE-2026-65400 was abused within two weeks of Apple's fix, with root access and Monero miners in every reported case. Patching closes the door; it does not evict anyone.
Perspective Coverage
6 publishersReality
CVE-2026-65400 let an attacker on the network authenticate to Screen Sharing without valid credentials. Apple's note names macOS Tahoe only, so treat wider backport claims as unconfirmed.
Reality
Huntress says a public proof of concept needs only an IP address to pull any file off unpatched Macs, driving a helper process that carries Full Disk Access.
Reality
An authentication state flaw lets anyone who reaches TCP/5900 skip credentials entirely. Multiple cases reported to NCSC-NL ended in root and a Monero miner.
Reality