How to protect your Mac from the screen sharing vulnerability

A critical macOS security flaw, tracked as CVE-2026-65400, allows unauthorized remote attackers to gain full root access to your computer. This vulnerability exists within the macOS screen sharing feature, which enables remote control of your keyboard, mouse, and display. If left unpatched, attackers can execute malicious code, such as cryptocurrency miners, on your system.

According to the Netherlands National Cyber Security Centrum (NCSC), this vulnerability is currently being actively exploited in the wild, particularly on systems where port 5900 is exposed to the public internet (NCSC, 2026). The flaw carries a severity rating of 7.1 out of 10, indicating a high risk to user data and system integrity.

What is the CVE-2026-65400 vulnerability?

CVE-2026-65400 is a high-severity security flaw in the macOS screen sharing subsystem that permits remote code execution with root privileges. The vulnerability stems from a state management error, where the system fails to properly track and validate user interactions and system events, allowing an attacker to bypass security controls and seize control of the machine (Ars Technica, 2026).

When a Mac has screen sharing enabled and is accessible via port 5900, an attacker can exploit this state management bug to gain the highest level of system access. Once root access is achieved, an attacker can install persistent malware, such as the Monero crypto miners observed by Dutch authorities, or steal sensitive personal information stored on your device.

How can you tell if your Mac is at risk?

Your Mac is primarily at risk if you have the Screen Sharing feature enabled and your network configuration allows incoming connections from the public internet. While most home routers block incoming traffic by default, users who have manually configured "port forwarding" to allow remote access to their Mac from outside their home network are the most vulnerable.

To check your current settings:

1. Open System Settings (or System Preferences).
2. Navigate to General and select Sharing.
3. Look for Screen Sharing in the list of services.
4. If the toggle is on, ensure that you are not exposing port 5900 to the public internet through your router's firewall settings.

How do you patch your Mac against this threat?

Apple has released security patches to address CVE-2026-65400 for macOS Tahoe, Sequoia, and Sonoma. Updating your operating system is the most effective way to eliminate the vulnerability. You should prioritize installing these updates immediately to ensure your system state management is secure and protected against unauthorized remote access.

Follow these steps to update your Mac:

1. Open the Apple menu in the top-left corner of your screen.
2. Select System Settings.
3. Click General in the sidebar.
4. Select Software Update.
5. If an update is available, click Update Now or Restart Now to apply the security patch.

What should you do if you suspect your Mac was compromised?

If you believe your system has been accessed by an unauthorized party, you should perform a security audit and reset your credentials. Because this vulnerability grants root access, attackers can potentially install persistent backdoors that remain even after a software update. If you detect suspicious performance, such as high CPU usage or unknown background processes, it is safest to back up your essential data and perform a clean install of macOS.

To mitigate ongoing risks, change your passwords for any sensitive accounts you accessed while the system may have been compromised. Additionally, verify that no unauthorized remote management tools were added to your login items or system launch agents. If you are unsure about your system's integrity, consult a professional IT security service to perform a forensic scan.