CVE-2026-65400: From Patch to Exploit in 4 Hours on macOS Screen…

The Dutch NCSC confirms active exploitation of CVE-2026-65400: a pre-authentication bypass in macOS Screen Sharing granting root access and deploying Monero miners.

According to the primary technical analysis available — published by Huntress on TechTimes and based on reverse-engineering by researcher Ryan Dowd — on August 12, 2026 the National Cyber Security Center of the Netherlands (NCSC) confirmed active exploitation of CVE-2026-65400. The vulnerability affects the macOS screensharingd daemon. The NCSC documents that attackers gain root access and install Monero cryptocurrency miners on systems with port 5900 exposed to the internet. Technical details on the bypass mechanism come from this single structured source; official Apple and NCSC sources confirm the vulnerability and active exploitation but do not provide mechanism analysis.

Key Takeaways

Pre-authentication bypass: According to Huntress analysis, a flaw in the screensharingd SRP validator returns a stale success state, allowing sessions without completing authentication.
Root access confirmed by NCSC: In all compromised systems detected by the Dutch NCSC, attackers obtained root privileges and installed a Monero miner.
Critical exposure condition: Exploitation requires port 5900/TCP (Screen Sharing/VNC) accessible from the internet; a scan found approximately 40,000 exposed hosts.
Timeline collapse: Apple released the patch on August 6; reverse-engineering produced a working exploit in roughly 4 hours, with public code by August 8.

The Mechanism: How an Encrypted Session Becomes Keyless Entry

The screensharingd daemon manages macOS Screen Sharing connections through the SRP (Secure Remote Password) protocol. According to analysis by Ryan Dowd of Huntress, published on TechTimes, the vulnerability lies in the SRP frame length validator: when the field exceeds a certain size, the system returns an unupdated success state, allowing the session before authentication completes.

The resulting session does not activate RSA-SRP encryption. Dowd notes this makes the traffic potentially detectable: in macOS's Endpoint Security framework, legitimate connections show authentication_type: RSA-SRP, while exploited ones appear as plaintext SRP. The source does not specify whether automated detection tools are already available.

Once the session is established, the attacker leverages the SSFileCopySender helper, which inherits the kTCCServiceSystemPolicyAllFiles entitlement. This permission — documented in the same analysis — grants full disk access and bypasses macOS TCC (Transparency, Consent and Control) protections. The result is privilege escalation without further exploits.

The Event Chain: 8 Days from Patch to NCSC Confirmation

Apple distributed the fix for CVE-2026-65400 on August 6, 2026 across three OS branches: macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. Official bulletins — published on support.apple.com — describe the flaw as "an authentication issue addressed with improved state management." The same official source credits discovery to Alfredo Pesoli, researcher at Bynario Atlas.

On the same day as the release, the Calif.io team completed reverse-engineering of the patch and produced a working exploit. Estimated time: roughly 4 hours. Proof-of-concept code went public on August 8. The Dutch NCSC issued advisory NCSC-2026-0280 on August 12, confirming active exploitation on "multiple systems" with port 5900 exposed.

"The NCSC has received a notification indicating active abuse of this vulnerability observed on multiple systems where port 5900 was accessible from the internet. In all these cases, root access was obtained on the affected system and a Monero cryptocurrency miner was placed." — National Cyber Security Center of the Netherlands, via SecurityAffairs (translated from English)

The NCSC quote, reported by multiple converging sources, establishes three combined elements: network exposure (port 5900), compromise with root access, and specific payload (Monero miner). No source currently documents use of the same flaw for data theft or other payloads.

The Severity Discrepancy and Documented Risk

A discrepancy between sources exists on severity metrics. SecurityAffairs reports CVSS 9.8 (critical), with a full network vector. Ars Technica indicates 7.1 (high). Apple has published no score in official bulletins. The official NVD figure is not cited in the dossier; the discrepancy between SecurityAffairs and Ars Technica remains unresolved in available sources.

The Apple bulletin uses conditional language: "An attacker on the network may be able to authenticate to Screen Sharing without valid credentials." The NCSC confirms root access and Monero miner in observed cases. No source classifies the vulnerability with "total impact" as a formal category.

A scan by @osxreverser had detected approximately 40,000 exposed Screen Sharing hosts, with nearly half in the United States; distribution includes residential, university, and enterprise systems. The researcher had anticipated the vulnerability's nature with the programmatic title: "It's a pre-auth, stupid!" A related flaw was patched in July; CVE-2026-65400 represents a deeper pre-authentication bug in the same daemon.

What to Do Now

Verified measures from the brief:

1. Update immediately to macOS Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9. Apple released the patch on August 6, 2026.

2. Verify port 5900/TCP exposure. The NCSC confirms all compromised systems had this port accessible from the internet. The source does not specify automated detection tools for exploited connections.

3. Recognize the ineffectiveness of conventional countermeasures. According to Huntress analysis, removing approved users, disabling the legacy VNC password, and rotating the VNC password operate downstream of the authentication path bypassed by the flaw.

4. Monitor plaintext SRP connections in the Endpoint Security framework, where legitimate sessions show authentication_type: RSA-SRP and exploited ones show SRP. The source does not confirm availability of automated tools for this detection.

Standard recommendations (not verified as primary source recommendations): limit exposure of remote desktop services through network controls; evaluate use of private networks for remote access.

Why It Matters

The CVE-2026-65400 case shows that established macOS components can hide pre-authentication bypasses with severe impact on exposed systems. Source convergence is on NCSC facts (active exploitation, root, Monero miner); technical details of the SRP mechanism come from the single structured source of Huntress/TechTimes.

The timeline — 4 hours of reverse-engineering, 2 days to public code, 8 days to exploitation confirmation — illustrates the speed at which patches become attack vectors. The window between fix availability and active exploitation is compressed relative to manual update cycles.

The Monero payload, with estimated revenue between $3 and $15 monthly per compromised Mac at residential electricity rates, indicates a volume attack on systems with exposed ports. The NCSC does not identify threat actors nor confirm exploitation onset before August 12, 2026.

Information verified against cited sources and current as of publication.

Sources

Sources and references