macOS Vulnerability: Hackers Exploit Screen Sharing Flaw

Dutch authorities have issued a critical alert regarding a high-severity macOS vulnerability that is currently under active exploitation. The Netherlands National Cyber Security Centrum (NCSC) observed multiple systems with port 5900 accessible from the internet being compromised. In these instances, attackers gained root access and deployed Monero cryptocurrency miners.

The vulnerability, identified as CVE-2026-65400, was addressed by Apple last week with a patch for macOS Tahoe, Sequoia, and Sonoma. Its severity rating is 7.1 out of 10, stemming from a flaw in the macOS screen sharing function's state management. This flaw could allow a remote party to control a Mac without credentials.

Exploitation occurs when port 5900 is exposed, a port that the macOS firewall opens during screen sharing sessions. While routers and firewalls typically block this port, attackers are targeting systems where it remains accessible. Security experts recommend blocking port 5900, using VPNs or SSH tunneling for secure remote access, and disabling screen sharing when not needed.

Currently, deployed malware is limited to Monero miners, which utilize a Mac's resources for cryptocurrency generation. However, there is a significant risk that attackers could leverage this vulnerability for more malicious purposes, such as installing credential-stealing malware or other harmful software.