On August 6, Apple released a macOS security update to patch a critical vulnerability in the Screen Sharing service, CVE-2026-65400, with a CVSS risk score of 7.1 (High). As long as Screen Sharing is enabled, any attacker on the network could potentially log in to the target Mac with any account without knowing the password. Apple acknowledged in the macOS Tahoe 26.6.1 support document that an attacker could authenticate through the Screen Sharing service without valid credentials, due to improper authentication state management. Apple fixed it by improving state management.
CVE-2026-65400: Pre-auth Authentication Bypass, PoC Publicly Released, Urgent Update Recommended
When macOS native screen sharing authenticates, it uses the Secure Remote Password (SRP) protocol to verify actual macOS user accounts, and research found that screensharingd has errors in the framing and validation of this authentication protocol. The problem lies not in SRP’s cryptography itself, but in its implementation and state management. This means the affected authentication path can be triggered without valid screen sharing credentials. Subsequent research shows that connections established after bypassing authentication can interact with privileged screen sharing file operation components, which carry Apple entitlements critical to system security, making this vulnerability far more severe than a typical authentication bypass.
Specifically, reverse engineering indicates that SSFileCopySender carries a highly sensitive Apple entitlement: com.apple.private.tcc.allow paired with kTCCServiceSystemPolicyAllFiles, meaning a session obtained after bypassing authentication can read and manipulate system-level file objects.
Why is this vulnerability tricky?
What makes this vulnerability particularly dangerous is that it sits at the pre-auth level. Attackers don’t need to log into the system first—as long as the target’s screen sharing port is exposed, anyone on the network who can reach that Mac has a chance to trigger the flaw.
Even more problematic, several common system protections are useless here. Analysis indicates that neither macOS’s System Integrity Protection (SIP) nor Privacy Protection (TCC) can render this authentication bypass “harmless,” and simply disabling VNC authentication cannot fix the vulnerability either. Even disabling traditional VNC authentication, removing screen sharing users, or changing the VNC password cannot block this vulnerability, because the issue lies in the Apple-native authentication path built into Screen Sharing, not in the VNC password mechanism.
Users who directly expose their Macs to the internet face the highest risk. Screen Sharing is not enabled by default on every Mac, which also limits the overall attack surface, but a growing number of enterprises use Macs as remotely managed workstations, development environments, hosted build machines, and even bare-metal servers. Cloud and infrastructure providers also offer Apple hardware such as the Mac mini for remote workloads. Newly provisioned systems may already have remote access enabled for management purposes, all of which expands the exposure scope.
PoC for a critical vulnerability in Apple macOS Screen Sharing (CVE-2026-65400).
If Screen Sharing is enabled, any network attacker can exploit the bug to log in as any account, without knowing the password.
We reverse engineered Apple’s unusual macOS 26.6.1 patch to understand… pic.twitter.com/WRIIwKx6yI
— Calif (@calif_io) August 8, 2026
It’s a different matter from the vulnerability patched in July.
CVE-2026-65400 is often compared to a previous screen sharing vulnerability, CVE-2026-43760. The two are distinct vulnerabilities: CVE-2026-43760 is a post-authentication issue where an attacker who has already successfully authenticated via the traditional VNC mechanism can abuse a privileged screen sharing file operation component, resulting in a confused condition. CVE-2026-43760 was patched in Apple’s security update on July 27.
In contrast, CVE-2026-65400 is an authentication bypass, allowing attackers to establish affected connections without legitimate screen-sharing credentials—a distinction that significantly raises the real-world risk. The July 27 update patched CVE-2026-43760, but subsequent research found that this version also impacted another pre-authentication-level authentication vulnerability, with the true fix not arriving until the August 6 version. Consequently, installing only the July 27 version cannot be considered a final remediation for CVE-2026-65400.
How to repair
Apple released a patch on August 6, and the affected versions cover all macOS versions prior to the update. The versions that need updating include:
- macOS Tahoe 26.6.1
- macOS Sequoia 15.7.9
- macOS Sonoma 14.8.9
Apple officially recommends that all users immediately update to the latest version to ensure system security. For administrators, the most direct fix is to install the security update from August 6, and they should also take inventory of remote Macs using screen sharing to confirm which systems have remote access enabled. There is currently no evidence that this vulnerability has been actively exploited in the wild. However, given that the PoC has been publicly released and the vulnerability is at the pre-authentication level, administrators should still complete the update as soon as possible to prevent malicious attackers from exploiting it before the patch is deployed and causing a security incident.
Source: KOCPC Chinese