Critical macOS Screen Sharing Bypass: CVE-2026-65400 Technical Advisory

An unauthenticated network attacker can bypass authentication controls and gain full interactive access to Apple Screen Sharing under a newly disclosed flaw, designated as CVE-2026-65400. Formally tracked as the Apple macOS Improper Authentication Vulnerability, the issue stems from a failure in logic handling during the initial remote desktop handshake, allowing remote actors to establish a valid Screen Sharing session without supplying legitimate credentials.

Technical Breakdown and Attack Path

The vulnerability resides within the authentication flow of screensharingd, the underlying daemon responsible for managing Apple Remote Desktop and VNC-based Screen Sharing connections on macOS. Categorized under CWE-287 (Improper Authentication), the flaw allows a remote client negotiating the protocol over TCP port 5900 (or customized Screen Sharing ports) to malform or truncate the authentication exchange. Instead of rejecting the unauthenticated handshake, the service misinterprets the response and grants interactive remote access.

The severity of this flaw is reflected in its maximum-severity CVSS score of 9.8, defined by the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Because the vulnerability requires no prior authorization, no complex user interaction, and operates over standard network routes, an attacker with line-of-sight to an exposed macOS host can move directly from network reconnaissance to interactive graphical UI access. From there, an adversary inherits the rights of the logged-in session, paving the way for immediate privilege escalation, credential dumping, and lateral movement across internal corporate subnets.

Exposure and Real-World Threat Dynamics

While the CVSS 9.8 rating underscores the theoretical lethality of an unauthenticated remote desktop bypass, current EPSS scoring places the 30-day probability of widespread exploitation at 0.50% (the 40.4th percentile of monitored vulnerabilities). This discrepancy highlights a common structural reality in enterprise environments: Screen Sharing is typically disabled by default on consumer Macs and restricted behind local network boundaries or MDM policies in enterprise deployments.

However, the operational risk remains severe for environments that rely on macOS endpoints for remote administration, developer workstations, or localized build servers. Attackers already inside an enterprise perimeter—or targeting improperly configured hosts exposed directly to the internet—can use this flaw as a reliable automated lateral movement vector. The threat is particularly elevated for hybrid workforces where internal endpoints communicate over flat office networks or legacy VPN configurations.

Remediation and Mitigation Guidance

Apple has issued security updates addressing this issue by hardening authentication state verification in screensharingd. To remediate CVE-2026-65400, administrators should deploy the following updates across all managed macOS fleets immediately:

• macOS Sonoma: Update to 14.8.9 or later
• macOS Sequoia: Update to 15.7.9 or later
• macOS 26: Update to 26.6.1 or later

If immediate patching is not feasible, organizations should implement the following targeted workarounds:

1. Disable Screen Sharing: Navigate to System Settings > General > Sharing and toggle off Screen Sharing and Remote Management (ARDAgent).
2. Network Filtering: Ensure incoming connections to TCP port 5900 and TCP port 3283 are blocked at the host network firewall (socketfilterfw) and boundary firewalls for untrusted networks.
3. Federal Compliance Note: U.S. federal agencies and organizations aligning with CISA Directive BOD 26-04 must complete remediation or apply approved mitigations prior to the enforced August 21, 2026 deadline.