Page generated: 10 Nov 2026, 16:18 UTC
← Dashboard

CVE-2026-65400

An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, macOS Tahoe 26.7. An attacker on the network may be able to authenticate to Screen Sharing without val…

Read full description
An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, macOS Tahoe 26.7. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.
CVSS 9.8 (CRITICAL) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
0.0/10
REALITY · THREAT PRIORITY
8.5/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 9.8: +1.47
  • Fresh EPSS: 1.72%: +0.01

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 26 documents and public datasets.

Hype components

Headline sample (25%)
0/100
Press, 30 days (60%)
0/100
Grounded branding (15%)
0/100
HYPE TOTAL0/100

Sources and documents

thezdi.com
Press · 16 Sep 2026, 07:00 · The Apple Security Update Review for September 2026 - thezdi.com
NeoTeo
Press · 08 Sep 2026, 07:00 · CVE-2026-65400: Update macOS Screen Sharing - NeoTeo
Resecurity
Press · 27 Aug 2026, 18:01 · CVE-2026-65400: macOS Screen Sharing Authentication Bypass Under Active Exploitation - Resecurity
Arctic Wolf
Press · 21 Aug 2026, 07:00 · Critical Remote Exploit in macOS Screen Sharing: CVE-2026-65400 - Arctic Wolf
The Hacker News
Press · 19 Aug 2026, 07:00 · Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation - The Hacker News
See all 26 source documents
Computer Weekly
Press · 18 Aug 2026, 07:00 · Apple addresses multiple WebKit vulnerabilities - Computer Weekly
Cyber Kendra
Press · 18 Aug 2026, 07:00 · Apple Patches 122 Flaws including macOS Screen Sharing Flaw (CVE-2026-65400) - Cyber Kendra
Bitdefender
Press · 17 Aug 2026, 14:12 · macOS ‘Screen Sharing’ flaw exploited for crypto-mining - Bitdefender
The Next Web
Press · 17 Aug 2026, 07:00 · The macOS Screen Sharing flaw took an AI four hours to crack - The Next Web
Check Point Research
Press · 17 Aug 2026, 07:00 · 17th August – Threat Intelligence Report - Check Point Research
Malwarebytes
Press · 17 Aug 2026, 07:00 · Update your Mac: Screen Sharing vulnerability exploited in the wild - Malwarebytes
SecurityWeek
Press · 17 Aug 2026, 07:00 · Recent macOS Screen Sharing Vulnerability Exploited in Attacks - SecurityWeek
The Hacker News
Press · 17 Aug 2026, 07:00 · ⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More - The Hacker News
Help Net Security
Press · 17 Aug 2026, 07:00 · Attackers exploit patched macOS Screen Sharing flaw to deploy cryptominer - Help Net Security
LinkedIn
Press · 16 Aug 2026, 07:00 · Critical Apple macOS Flaw Exploited To Gain Root Access - LinkedIn
Tom's Hardware
Press · 16 Aug 2026, 07:00 · Critical macOS Screen Sharing flaw gives attackers remote root access — CISA bumps bug to 9.8 severity following active Monero cryptojacking attacks - Tom's Hardware
The Hacker News
Press · 15 Aug 2026, 07:00 · Apple macOS Screen Sharing Flaw Exploited on Internet-Exposed Macs to Install Monero Miner - The Hacker News
Security Affairs
Press · 15 Aug 2026, 07:00 · macOS Screen Sharing Flaw Exploited to Deploy Monero Miners - Security Affairs
Ars Technica
Press · 14 Aug 2026, 07:00 · Vulnerability giving attackers full control of Macs is under active exploitation - Ars Technica
SC Media
Press · 14 Aug 2026, 07:00 · MacOS screen sharing vulnerability actively exploited for crypto mining - SC Media
BleepingComputer
Press · 14 Aug 2026, 07:00 · Hackers exploit macOS Screen Sharing flaw to deploy Monero miner - BleepingComputer
TechRepublic
Press · 10 Aug 2026, 07:00 · Apple Patches Mac Screen Sharing Flaw That Could Bypass Authentication - TechRepublic
GBHackers News
Press · 08 Aug 2026, 07:00 · Critical macOS RCE Vulnerability Allows Attackers to Gain Root Access Without Password - GBHackers News
Huntress
Press · 07 Aug 2026, 07:00 · From Screen Share to Root Access: Breaking Down CVE-2026-43760 and CVE-2026-65400 on macOS - Huntress
Hong Kong Computer Emergency Response Team Coordination Centre
Press · 07 Aug 2026, 07:00 · Apple macOS Security Restriction Bypass Vulnerability - Hong Kong Computer Emergency Response Team Coordination Centre
9to5Mac
Press · 06 Aug 2026, 07:00 · Apple’s latest macOS updates address a serious Screen Sharing vulnerability - 9to5Mac

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.5 (2026-11-02 15:14). The curve appears once the score changes.

Public exploit evidence

1

Public exploit entries / repo candidates

See 1 repos with metrics
RepositoryStarsForksLanguageUpdated
panchocosil/CVE-2026-65400-poc101Python22 Aug 2026, 17:57
Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 9.8; EPSS 1.7%
Attention, last 30 days
0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential
network access, no prior privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 14:00:19.801232+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
First press mention
06 Aug 2026, 07:00
Published
06 Aug 2026, 18:17
Added to the CISA KEV catalog
18 Aug 2026, 00:00
Latest press mention
16 Sep 2026, 07:00
Score calculated
05 Nov 2026, 14:00
PoCs on GitHub
1 repositories