CVE-2026-65400: 
macOS vulnerability analysis and mitigation

CVE-2026-65400 is an authentication bypass vulnerability in macOS Screen Sharing that allows a network-adjacent attacker to authenticate without valid credentials. The root cause is improper state management in the Screen Sharing authentication flow. It affects macOS Sonoma (before 14.8.9), macOS Sequoia (before 15.7.9), and macOS Tahoe (before 26.6.1). The vulnerability was discovered by Alfredo Pesoli (@__rev) via Bynario Atlas (bynar.io) and disclosed on August 6, 2026. A formal CVSS score has not yet been published; Feedly estimates severity as MEDIUM with an EPSS score of 0.0 (Apple Sequoia Advisory, Apple Sonoma Advisory, Apple Tahoe Advisory).

The vulnerability stems from improper state management in the macOS Screen Sharing (VNC-based remote desktop) service, classified as an authentication issue (no CWE has been formally assigned). An attacker positioned on the same network as the target can exploit flawed authentication state transitions to bypass credential validation entirely. No public proof-of-concept or detailed technical write-up has been released as of the disclosure date, and the precise mechanism of the state management flaw has not been publicly documented (Apple Sequoia Advisory, GitHub Advisory).

Successful exploitation grants an unauthenticated, network-adjacent attacker full access to the target system's Screen Sharing session, including remote viewing and control of the screen and input devices (keyboard and mouse). This effectively provides interactive remote access equivalent to physical presence at the machine, enabling data exfiltration, installation of malware, lateral movement within the local network, or further privilege escalation. All macOS versions across three major release lines (Sonoma, Sequoia, Tahoe) are affected when Screen Sharing is enabled (Apple Tahoe Advisory, Apple Sequoia Advisory).

As of the disclosure date (August 6, 2026), there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation. The EPSS score is 0.0, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires network adjacency (the attacker must be on the same network as the target) and that Screen Sharing be enabled on the target system, which limits the attack surface compared to fully remote vulnerabilities (Apple Sequoia Advisory, GitHub Advisory).

Apple has released patches addressing this vulnerability in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9, all published on August 6, 2026. Users should update to the appropriate patched version immediately via System Settings > Software Update. As an interim workaround, disable Screen Sharing (System Settings > General > Sharing > Screen Sharing) if it is not required, and restrict Screen Sharing access to trusted networks using firewall rules or network segmentation to limit exposure to potential network-adjacent attackers (Apple Tahoe Advisory, Apple Sequoia Advisory, Apple Sonoma Advisory).

The vulnerability received notable media coverage shortly after disclosure, with outlets including 9to5Mac, Lifehacker, and OSXDaily reporting on the Screen Sharing authentication bypass. Security researcher Will Dormann (@wdormann) commented on the vulnerability via Mastodon (infosec.exchange). Coverage generally characterized the flaw as serious given its potential for unauthenticated remote access, though the network-adjacency requirement was noted as a mitigating factor. Tenable released Nessus detection plugins (IDs 333123, 333124, 333125) for the affected macOS versions (9to5Mac, Lifehacker).