macOS Screen Sharing RCE: Patch CVE-2026-65400 Now

Apple has shipped emergency macOS updates to close a critical flaw in its Screen Sharing service that can let an unauthenticated attacker execute code and read or write files with root-level privileges. Tracked as CVE-2026-65400, the vulnerability is most dangerous on Macs whose Screen Sharing service is reachable from an untrusted network — and public proof-of-concept research already demonstrates the file access it enables. Administrators are urged to update immediately or disable Screen Sharing until they can.

The affected versions

Apple’s fixes landed on August 6, 2026 across three supported macOS lines:

• macOS Tahoe 26.6.1
• macOS Sequoia 15.7.9
• macOS Sonoma 14.8.9

Each of these releases fully addresses CVE-2026-65400. Any Mac running an earlier build with the Screen Sharing service enabled should be considered exposed. Apple’s advisory does not state that the vulnerability has been actively exploited in the wild, but the combination of a pre-authentication path and root-level impact is exactly the profile that draws attackers quickly once details are public — and details are now public.

What the flaw does

CVE-2026-65400 lives in screensharingd, the daemon behind macOS Screen Sharing, and specifically in how that daemon handles Secure Remote Password (SRP) authentication — the cryptographic exchange meant to prove a connecting client knows the right password without ever sending it.

According to the researcher Ryan Dowd, who traced the bug, the defect is an erroneous frame-length validation path. When the daemon processes a malformed authentication frame, that faulty path returns a stale success state — in effect, the connection is treated as authenticated even though the SRP handshake never actually completed. An attacker who can reach the service can therefore be admitted without knowing any password.

That is the whole ballgame. Once a connection is treated as authenticated, follow-on research showed it can be driven toward:

• Arbitrary file reads and writes as root, demonstrated by public proof-of-concept code.
• Remote code execution, established by later work that built on the file-access primitive.
• Persistence, using standard macOS footholds such as LaunchDaemons or modifications to shell startup files, so an intruder survives a reboot.

The escalation from “read a file” to “run code as root and stay resident” is the reason this bug is rated critical rather than merely serious. An authentication bypass that yields root is close to the worst outcome a networked service can offer.

How exposed are you?

The risk is not uniform. Screen Sharing is off by default on macOS, and a Mac that never enables it is not running the vulnerable listener. The danger concentrates on machines where the service is turned on and reachable — remote-administered Macs, shared lab or studio machines, and, most dangerously, any Mac whose Screen Sharing port is exposed to the public internet rather than confined to a trusted LAN or a VPN.

This is a familiar shape. A zero-day vulnerability in a network-facing service is dangerous in direct proportion to how many instances are listening where strangers can reach them. The same reasoning drove the urgency around other recent pre-auth flaws we have covered, from the Zoom account-takeover bug to the steady drumbeat of high-severity fixes in Microsoft’s record July patch cycle. The pattern holds: authentication logic is subtle, a single mishandled edge case can collapse it entirely, and remote-administration services are a perennial soft target because they must, by design, accept connections from elsewhere.

What to do now

The response checklist is short and non-negotiable:

1. Patch. Update to macOS Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9 on every Mac you manage. On fleets, push the update through your MDM rather than trusting users to run it.
2. Disable Screen Sharing anywhere it is not actively needed. If you cannot patch immediately, turning the service off removes the vulnerable listener entirely.
3. Never expose Screen Sharing to the internet. Put remote-administration access behind a VPN or an equivalent access-control layer, and restrict it to known source addresses.
4. Hunt for persistence on any Mac that had the service exposed. Because the bug enables root file writes, check for unexpected LaunchDaemons and modified shell startup files — the exact footholds researchers flagged — rather than assuming a clean patch equals a clean machine.

Building that last habit into normal operations is what mature threat modeling looks like: assume a reachable, pre-auth, root-level bug may already have been used, and verify rather than hope.

What it means

CVE-2026-65400 is a clean illustration of why authentication code deserves outsized scrutiny. The flaw is not an exotic memory-corruption chain; it is a logic error in state handling — a validation path that returns success when it should return failure. Bugs of that class are easy to introduce, hard to spot in review, and catastrophic when they sit in front of a service that runs as root.

The near-term impact is contained by defaults: because Screen Sharing ships off, most consumer Macs are not exposed, and Apple’s fix is already available. The organizations that should be worried are the ones running remotely administered Mac fleets — creative studios, developer shops, and enterprises that lean on Screen Sharing for support. For them, the window between public proof-of-concept and opportunistic scanning is the risk, and it is open now.

Two things are worth watching. First, whether in-the-wild exploitation reports emerge; Apple’s advisory currently claims none, but pre-auth root bugs with public PoCs rarely stay theoretical for long. Second, whether this accelerates a broader move to treat remote-administration services as never-internet-facing by default — the same architectural lesson that keeps recurring every time an authentication bypass turns a convenience feature into a root shell. The patch closes this hole. The habit of not exposing the service in the first place is what closes the next one.