Apple macOS Improper Authentication Vulnerability
TL;DR 📌
- Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.
- Highest CVSS: 9.8 (Critical).
- Listed in CISA KEV (2026-08-18) — this is being exploited in the wild.
- Check the advisory for fixed releases — remediation detail is in the vendor link below.
- CVEs: CVE-2026-65400.
What it is
CVE-2026-65400 is an improper authentication flaw in macOS Screen Sharing. The vulnerability allows an attacker on the network to authenticate to Screen Sharing without supplying valid credentials.
The CVSS vector shows this is reachable over the network with low attack complexity and no privileges or user interaction required (AV:N/AC:L/PR:N/UI:N). This points to a flaw in Screen Sharing’s authentication handling itself rather than a client-side issue needing user action. Successful exploitation gives high impact to confidentiality, integrity and availability, consistent with an attacker gaining an authenticated session on the target Mac.
The vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalogue, added on 2026-08-18. This means it is known to be exploited.
Affected macOS versions are not stated here; consult Apple’s advisory for the specific releases in scope. No fixed releases are listed at this point — check Apple’s advisory directly for update availability.
What to do
- Check Apple’s advisory at the CVE-2026-65400 page for the specific macOS versions affected and for any update once published.
- Until a fix is confirmed, disable Screen Sharing on any Mac where it is not strictly required, particularly on machines reachable from untrusted networks.
- Where Screen Sharing must remain enabled, restrict access at the network level — firewall rules or VPN-only access — so it is not reachable from the open network.
- Given this is listed in CISA KEV, treat patching as urgent once Apple issues a fix, and prioritise identifying all Macs with Screen Sharing enabled in your estate now rather than waiting for the patch.
- Review Screen Sharing logs and remote access history on exposed machines for signs of unexpected sessions.
For leadership 🧭
Executive summary. An unauthenticated attacker who can reach a Mac’s Screen Sharing service over the network can gain a full remote session without any credentials, and this is already being exploited. Because no fix is yet listed, exposed Macs need attention today, not after the next patch cycle.
Why it matters:
- The flaw sits in Screen Sharing’s authentication handling itself, so no password guessing, phishing or user interaction is needed to get in
- CVSS 9.8 with full confidentiality, integrity and availability impact means a successful login gives an attacker an authenticated session equivalent to physical access to the Mac
- CISA has added this to its Known Exploited Vulnerabilities catalogue, confirming active exploitation against real deployments
- Any Mac with Screen Sharing enabled and reachable from an untrusted network - including via port forwarding or flat office networks - is exposed until Apple ships a fix
Now / Next / Later:
- Now: Identify every Mac in the estate with Screen Sharing enabled and disable it on any machine where it isn’t strictly needed, especially those reachable from untrusted networks.
- Next: For Macs that must keep Screen Sharing on, move access behind a firewall rule or VPN so the service is never exposed to the open network, and check Apple’s advisory page for a fixed release to apply.
- Later: Build a standing check into device management for remote-access services like Screen Sharing so they default to off and require explicit, network-restricted enablement.