Apple Ships an Emergency macOS Fix for a Screen Sharing Authentication Bypass

CVE-2026-65400 is rated CVSS 9.8. Apple's own impact line says an attacker on the network may be able to authenticate to Screen Sharing without valid credentials. It is the fifth Screen Sharing CVE Apple has fixed in ten days.

State of Surveillance Editorial Team

TL;DR: On August 6, 2026, Apple shipped three macOS point releases that each fix exactly one vulnerability. The component is the one Apple calls "Screen Sharing," and the impact line is identical on all three advisories: "An attacker on the network may be able to authenticate to Screen Sharing without valid credentials" [1][2][3]. The flaw is CVE-2026-65400, scored CVSS 3.1 9.8 critical and classified CWE-287, improper authentication [4]. The fixed versions are macOS Tahoe 26.6.1, macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9, credited to Alfredo Pesoli (@__rev) via Bynario Atlas [1]. Apple's advisory says nothing about exploitation in the wild; separately, CISA's SSVC data mirrored in the NVD record listed exploitation as "none" as of August 14, 2026 [4]. The patch arrives ten days after a routine release that closed four Screen Sharing Server CVEs [7][8].

The Credential Check Is the Part That Broke

Most macOS advisories describe a memory-safety bug whose consequences take a paragraph to unpack. This one does not. Apple states the outcome in a single sentence: "An attacker on the network may be able to authenticate to Screen Sharing without valid credentials" [1][2][3]. Screen Sharing is the macOS service that lets a remote viewer see and control the desktop. The part meant to keep an unknown party out is the part Apple says failed.

Apple's technical description is also one line: "An authentication issue was addressed with improved state management" [1]. NVD assigns a CVSS 3.1 base score of 9.8 critical with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, under CWE-287 [4]. In plain terms: the attack arrives over the network, is low complexity, needs no privileges and needs no user interaction, with high impact to confidentiality, integrity and availability. Nobody has to click anything, and no account has to be compromised first. CISA's structured assessment in the same record rates the technical impact "total" and marks the issue "automatable" [4].

Apple's impact line stops at authentication and does not spell out what follows. Remote viewing and control of the screen is simply what Screen Sharing does once a session is authenticated. And one thing this is not: nothing in Apple's advisory or the NVD record ties CVE-2026-65400 to TCC, the macOS privacy framework behind screen-recording consent prompts [1][4]. This is a failure inside a network service's own login gate, a different mechanism from a permission prompt being sidestepped.

A Point Release for a Single Bug

The shape of the fix is part of the story. Apple did not fold CVE-2026-65400 into a routine cycle alongside dozens of other patches. It shipped three dedicated point releases on August 6, 2026, and each advisory lists this one CVE [1][2][3]. Apple Product Security pushed the same notices through its signed mailing list that afternoon, as APPLE-SA-08-06-2026-2 for Sequoia 15.7.9 and APPLE-SA-08-06-2026-3 for Sonoma 14.8.9 [5][6]. The scope is macOS only: none of the three advisories lists iOS, iPadOS, tvOS, watchOS or visionOS as affected, and the NVD record names only macOS [2][4].

What Apple Did Not Say

Apple has standard language for flaws it has reports of being attacked before a patch shipped. That language does not appear here. Each CVE entry on the three advisories runs to component, availability, impact, description and credit, with no line about exploitation [1][2][3]. The absence is worth stating carefully, because it is an absence and not a denial. Apple makes no claim that CVE-2026-65400 was exploited in the wild, and Apple also did not say it was not exploited.

A separate data point comes from CISA. The NVD entry carries a CISA Coordinator SSVC record timestamped August 14, 2026, in which the exploitation field reads "none" [4]. That is CISA's assessment on that date, mirrored by NVD, and not an Apple statement. The CVSS score is a third thing again: it estimates severity and reachability, not whether anyone has used the bug.

Five Screen Sharing CVEs in Ten Days

Ten days earlier, on July 27, 2026, Apple's routine cycle closed four distinct CVEs in a component named "Screen Sharing Server," and those fixes did not land uniformly across the three macOS lines [7][8].

CVE-2026-43779, "An app may be able to intercept network connections intended for another process," was fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8 and macOS Tahoe 26.6, scored CVSS 3.1 9.8 critical under CWE-284 [10]. CVE-2026-43777, "A remote attacker may be able to cause a denial of service," reached the same three versions at 7.5 high [11]. CVE-2026-43665, "A local attacker may be able to determine the legacy VNC password configured for Screen Sharing," was fixed in Sequoia 15.7.8 and Sonoma 14.8.8 only [12]. CVE-2026-43760, "An app may be able to access user-sensitive data," was fixed in Sonoma 14.8.8 and Tahoe 26.6, and does not appear on the Sequoia 15.7.8 advisory at all [8][9].

The 9.8 on CVE-2026-43779 matches the 9.8 on CVE-2026-65400, and that match is a coincidence of scoring rather than a statement that the two carry the same real-world risk. Apple's wording for 43779 describes an app intercepting traffic meant for another process, which presumes something already running on the machine. Apple's wording for 65400 describes an attacker on the network with no stated foothold. The comparison that matters is what an attacker needs before starting, not the number.

The Same Researcher, a Very Different Starting Point

Alfredo Pesoli of Bynario Atlas is credited on both CVE-2026-65400 and the earlier CVE-2026-43760, whose credit line on the macOS Tahoe 26.6 advisory reads "CVE-2026-43760: Alfredo Pesoli (@__rev) of Bynar.io, wdszzml and Atuin Automated Vulnerability Discovery Engine" [7].

The contrast between the two is the clearest way to see why the August bug is the worse one. In a July 29 writeup on his company's blog, Pesoli set out the preconditions for the earlier flaw: "This is post authentication, the target Mac must have Screen Sharing or Remote Management enabled, the option 'VNC viewers may control screen with password' must be configured, and the attacker must know that VNC password" [13]. CVE-2026-65400, by Apple's own description, requires no credentials at all.

Pesoli argues in that same post that Apple's severity language for the July flaw understated it, writing that he would tell "the story of how one legacy Screen Sharing authentication path turned ordinary file copy into protected file disclosure, arbitrary root file creation, and ultimately remote root command execution (and how we think 'An app may be able to access sensitive user data' could be underplaying what the bug really is)" [13]. That is the finder's characterisation of Apple's wording, reported as his position rather than adopted as a conclusion. At a high level he describes chaining a file-access issue into remote root command execution; the mechanism is not reproduced here. CISA's SSVC record for that CVE, timestamped July 30, 2026, lists exploitation as "poc," a value indicating a proof of concept is known to exist and consistent with the finder publishing his own writeup, not an indication that anyone attacked real users [9].

What Mac Owners Should Do

Update to the version matching the Mac's OS line [1][2][3]:

  • macOS Tahoe: update to 26.6.1. Sitting on top of 26.6, it also carries the July 27 Screen Sharing Server fixes.
  • macOS Sequoia: update to 15.7.9.
  • macOS Sonoma: update to 14.8.9. It sits on top of 14.8.8, which closed CVE-2026-43760.

Anything below those versions on those three lines is listed as affected. iPhones, iPads, Apple TVs, Apple Watches and Vision Pro are not listed as affected by this CVE [1][4].

There is a blunter measure for anyone who does not use remote access. Screen Sharing has to be switched on to be running at all, and the finder's own precondition list for the July flaw names an enabled Screen Sharing or Remote Management as a requirement [13]. A Mac where the service was never turned on is not exposing it. Checking that state on each machine, and switching the service off where it is on but unused, removes the attack surface for both CVE clusters instead of only patching it. Neither Apple's advisory nor the finder's writeup presents this as the mitigation for CVE-2026-65400, so treat it as general defensive posture. Installing the update is the fix Apple shipped.

What to Watch

Whether CISA's exploitation status moves. The "none" value is a snapshot dated August 14, 2026, on a record NVD last modified August 15 [4]. SSVC values change as evidence arrives, so that field is the one to recheck. The CVSS score will not move.

Whether Apple amends the advisory. If in-the-wild reports reach the company, the exploitation line would appear on these three pages [1][2][3].

Whether Bynario publishes on this one. As of publication, the firm's most recent relevant post is the July 29 piece about CVE-2026-43760, not the August flaw [13]. A dedicated writeup would be the first detailed public account of the newer authentication failure.

Whether the count keeps rising. Five Screen Sharing and Screen Sharing Server CVEs across two releases in ten days, from at least four separate finders, points to a component under sustained review [7][8][10][11][12]. The next routine macOS cycle will show whether that continues.

Sources

  1. Apple Support: About the security content of macOS Tahoe 26.6.1, published August 6, 2026. https://support.apple.com/en-us/148170
  2. Apple Support: About the security content of macOS Sequoia 15.7.9, published August 6, 2026. https://support.apple.com/en-us/148171
  3. Apple Support: About the security content of macOS Sonoma 14.8.9, published August 6, 2026. https://support.apple.com/en-us/148172
  4. National Vulnerability Database, CVE-2026-65400 record (published August 6, 2026; last modified August 15, 2026; CVSS 3.1 vector, CWE-287, and the CISA Coordinator SSVC block dated August 14, 2026). https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-65400
  5. Apple Product Security: APPLE-SA-08-06-2026-2 macOS Sequoia 15.7.9, Full Disclosure mailing list archive, August 6, 2026. http://seclists.org/fulldisclosure/2026/Aug/37
  6. Apple Product Security: APPLE-SA-08-06-2026-3 macOS Sonoma 14.8.9, Full Disclosure mailing list archive, August 6, 2026. http://seclists.org/fulldisclosure/2026/Aug/36
  7. Apple Support: About the security content of macOS Tahoe 26.6, published July 27, 2026. https://support.apple.com/en-us/128067
  8. Apple Support: About the security content of macOS Sequoia 15.7.8, published July 27, 2026. https://support.apple.com/en-us/128071
  9. National Vulnerability Database, CVE-2026-43760 record (CVSS 3.1 8.6 high; CISA Coordinator SSVC block dated July 30, 2026). https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-43760
  10. National Vulnerability Database, CVE-2026-43779 record (CVSS 3.1 9.8 critical, CWE-284). https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-43779
  11. National Vulnerability Database, CVE-2026-43777 record (CVSS 3.1 7.5 high). https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-43777
  12. National Vulnerability Database, CVE-2026-43665 record. https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-43665
  13. Bynario, Alfredo Pesoli: A root remote command execution on macOS with M5 in 2026?, July 29, 2026. https://bynar.io/blog/a-root-remote-command-execution-on-macos-with-m5-in-2026