CISA Raises macOS Screen Sharing Bug to Critical 9.8 as Hackers Mine Crypto on Hacked Macs

The U.S. Cybersecurity and Infrastructure Security Agency raised the severity of a patched macOS Screen Sharing flaw from 7.1 to a critical 9.8 on August 14, after security researchers confirmed attackers are using it to break into Macs and install Monero cryptocurrency miners. Apple fixed the underlying bug, tracked as CVE-2026-65400, on August 6, but any Mac that has not installed that update is still exposed.

The rescore matters because it changes how urgent the patch is. CISA's original rating assumed an attacker needed some level of access to exploit the flaw. Its revised assessment treats the attack as automatable and capable of full compromise with no privileges required at all, which is why the score jumped so sharply.

What the flaw actually does

CVE-2026-65400 sits in how the Screen Sharing service implements Secure Remote Password authentication. A flaw in how the daemon validates connection frame lengths let it treat unauthenticated sessions as if they had already passed a password check, opening a path to remote code execution as root with no credentials at all. Security researchers at Huntress, who broke down the bug in detail, also flagged a second, less severe issue, CVE-2026-43760, that lets an already-authenticated attacker read and write files as root through the legacy VNC connection method. Apple closed that one on July 27 and closed CVE-2026-65400 on August 6.

According to research shared by the Dutch National Cyber Security Centre, real-world attacks follow the same pattern in every case reported so far: a Mac with port 5900 exposed to the open internet gets scanned, the Screen Sharing service is compromised, the attacker gains root, and a Monero cryptomining process is dropped onto the machine. Port 5900 is the standard port for VNC-based screen sharing, and a Mac only exposes it there if Screen Sharing has been turned on and the network or router forwards that port to the internet.

Who is actually at risk

Apple's own advisory notes that a Mac is only affected if Screen Sharing was manually enabled before installing the fix. Most Mac owners never turn this feature on, and even fewer expose port 5900 to the wider internet rather than just their local network. The people at real risk are a specific slice of users: Mac Mini and Mac Studio owners running them as remote servers, small businesses using a Mac for remote access, and anyone who forwarded port 5900 through their router for convenience.

Unlike some past Screen Sharing bugs, disabling the feature after the fact is not a reliable workaround here, since the flawed authentication check happens before any password would normally be verified. Huntress's guidance is blunt: patch now, and if patching immediately is not possible, block port 5900 at the router or firewall rather than relying on toggling Screen Sharing off.

How to check and fix it

• Open System Settings > General > Software Update and confirm you are running macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, or macOS Sonoma 14.8.9 or later.
• If you are on an older build, install the update immediately rather than waiting for the next scheduled patch cycle.
• If Screen Sharing is enabled in System Settings > General > Sharing and you do not actively use it for remote access, turn it off.
• If you rely on Screen Sharing for legitimate remote access, restrict it to a VPN or SSH tunnel instead of forwarding port 5900 directly to the internet.

This is a narrower risk than a flaw like the recent mercenary spyware campaign Apple warned iPhone users about, since it requires a specific, uncommon configuration. But for the Macs that do have port 5900 exposed, active cryptojacking means the exploit is not theoretical. If your Mac has been noticeably slower or hotter than usual since early August, an unauthorized Monero miner running in the background is now a plausible explanation worth ruling out.