macOS Screen Sharing Flaw Grants Remote Attackers Root Access

A critical security vulnerability in the macOS Screen Sharing feature has left Mac users exposed to complete system compromise by remote attackers. The flaw allows unauthorized actors to bypass authentication entirely, granting them root-level access to affected machines without requiring a username or password.

Tracked as CVE-2026-65400, the vulnerability affects the built-in Screen Sharing tool, which utilizes the VNC protocol on TCP port 5900. The bug resides in the `screensharingd` daemon and is triggered when the daemon mishandles oversized data frames. This error causes the system to return a stale success code, effectively tricking the software into skipping the authentication process and granting entry to the attacker.

The Technical Breakdown

Screen Sharing is a native macOS utility designed for remote desktop management. In this instance, the failure of the authentication routine to properly process oversized data frames created a critical gap in the system's perimeter. Once the authentication bypass is achieved, attackers gain the ability to read and write arbitrary files as the root user. While Apple's System Integrity Protection (SIP) may block certain types of direct code execution, it does not prevent the initial unauthorized access or the ability of an attacker to read the entire disk.

Industry Implications

This vulnerability is categorized as high-severity because it provides "pre-auth" root access. This means any attacker positioned on the same network as a vulnerable Mac can compromise the machine without any credentials or user interaction. The real-world danger of the flaw has already been realized; security researchers have observed active exploitation in the wild. Specifically, threat actors have been leveraging the bug to deploy Monero cryptocurrency miners, turning compromised Macs into nodes for illicit mining operations.

What to Watch

With active exploitation confirmed, immediate patching is critical for all macOS users who have Screen Sharing enabled. Security professionals are advising users to update their systems to the latest version of macOS to close the hole in `screensharingd`. Administrators should also consider auditing their network for open TCP port 5900 traffic to identify potentially exposed machines. While the primary exploit mechanism is understood, the full extent of how many systems have been compromised for cryptocurrency mining remains unconfirmed.