macOS Screen Sharing Vulnerability Exploited, Hackers Gain Root Privileges and Deploy XMR Mining Malware

According to the Dutch National Cyber Security Center (NCSC-NL), attackers are exploiting a critical authentication vulnerability CVE-2026-65400 in macOS’s screen sharing function to launch attacks on Mac devices exposed to the internet. The vulnerability has a CVSS score of 9.8, allowing attackers to bypass authentication and gain root system privileges without valid credentials. NCSC-NL noted it has received multiple reports of active exploitation; affected devices have port 5900 directly accessible from the internet. In all confirmed cases, attackers successfully obtained root access and deployed Monero (XMR) mining software on compromised Macs. Apple recently patched the vulnerability via macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. Security Affairs advises users who have enabled screen sharing and not yet updated their systems to upgrade immediately; if an update is temporarily unavailable, they should disable screen sharing to avoid exposing port 5900 to the internet.